v0.13.17 — sync release (no functional changes; actual fix is autorip hot-plug)

Pre-0.13.16 the rip API leaked internal mapfile concepts (pos,
bytes_good, work_done, bytes_pending, Finished/NonTrimmed) into per-pass
positional callbacks Fn(u64, u64, u64). Consumers reinvented the math
each time, and v0.13.15's UI bug surfaced exactly because of this —
autorip's web JS computed pct from bytes_good while the backend
computed from pos, silent drift, frozen UI bar.

This release replaces both Disc::copy::on_progress and
Disc::patch::on_progress callbacks with a single Progress trait +
PassProgress struct (new progress module).

  pub struct PassProgress {
      pub kind: PassKind,            // Sweep | Trim {reverse} | Scrape {reverse} | Mux
      pub work_done: u64,
      pub work_total: u64,
      pub bytes_good_total: u64,
      pub bytes_total_disc: u64,
  }

  pub trait Progress {
      fn report(&self, p: &PassProgress);
  }

  impl<F: Fn(&PassProgress)> Progress for F { ... }   // closures work directly

CopyOptions::on_progress and PatchOptions::on_progress are renamed to
progress: Option<&dyn Progress>. Closure callers update trivially via
the blanket impl; struct callers gain a clean named-field shape with no
positional-arg confusion.

PassKind carries the semantic (sweep vs trim vs scrape vs mux) so
consumers can label phases without reinventing detection logic.
Disc::patch reports Trim {reverse} for retry passes with block_sectors
>= 2 and Scrape {reverse} when block_sectors == 1. Direction comes
through reverse: bool. Mux variant is reserved for v0.13.17 when the
mux pipeline emits progress.

Tests + clippy clean across all 4 crates.

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@1.86.0
-      - run: cargo test
+      - run: cargo test --tests
 
   check-macos:
     runs-on: macos-latest

CHANGELOG.md

@@ -1,5 +1,918 @@
 # Changelog
 
+## 0.13.17 (2026-04-26)
+
+### Sync release — no functional changes
+
+Bumped to satisfy the unified-versioning rule. Actual fix is in autorip
+(hot-plug rescan in the drive poll loop — autorip now picks up
+unplug/replug events without a container restart).
+
+## 0.13.16 (2026-04-26)
+
+### Architecture: single `Progress` trait + `PassProgress` struct
+
+Pre-0.13.16 the rip API leaked internal mapfile concepts (`pos`,
+`bytes_good`, `work_done`, `bytes_pending`, `Finished`/`NonTrimmed`)
+into per-pass positional callbacks. Consumers reinvented the math each
+time, and the v0.13.15 UI bug surfaced exactly because of this — autorip's
+web JS computed `progress_pct` from `bytes_good` while the backend
+computed from `pos`, silent drift, frozen UI bar.
+
+This release replaces both `Disc::copy::on_progress` and
+`Disc::patch::on_progress` `Fn(u64, u64, u64)` callbacks with a single
+`Progress` trait and `PassProgress` struct (new `progress` module).
+
+```rust
+pub struct PassProgress {
+    pub kind: PassKind,            // Sweep | Trim {reverse} | Scrape {reverse} | Mux
+    pub work_done: u64,
+    pub work_total: u64,
+    pub bytes_good_total: u64,
+    pub bytes_total_disc: u64,
+}
+
+pub trait Progress {
+    fn report(&self, p: &PassProgress);
+}
+
+impl<F: Fn(&PassProgress)> Progress for F { ... }
+```
+
+Both `CopyOptions::on_progress` and `PatchOptions::on_progress` are
+renamed to `progress: Option<&dyn Progress>`. Closure callers update
+trivially; struct callers gain a clean named-field shape with no
+positional-arg confusion.
+
+`PassKind` carries the semantic (sweep vs trim vs scrape vs mux) so
+consumers can label phases without reinventing detection logic. The
+`Mux` variant is reserved for v0.13.17 when the mux pipeline emits
+progress; not yet emitted by libfreemkv code.
+
+`Disc::patch` reports `Trim {reverse}` for retry passes with
+`block_sectors >= 2` and `Scrape {reverse}` when `block_sectors == 1`
+(the per-sector final pass). Direction comes through `reverse: bool`.
+
+## 0.13.15 (2026-04-26)
+
+### Breaking: `on_progress` callback gains `pos` parameter
+
+Both `CopyOptions::on_progress` and `PatchOptions::on_progress` now take
+`Fn(bytes_good: u64, pos: u64, total_bytes: u64)`. The new `pos` parameter
+is the current sweep / retry position. Pass 1 callers should display
+`pos / total_bytes` for the "% swept" UI bar — `bytes_good` only counts
+clean reads (Finished sectors) and freezes during skip-forward bad zones,
+which made every previous version's UI look hung at the bad-zone boundary.
+This was the v0.13.9 stall-guard origin bug.
+
+Live trace from v0.13.14: Pass 1 hit a Dune 2 bad zone at 24 GB and
+appeared "stuck" for 14 minutes per autorip's UI (`bytes_good = 23.97 GB`
+unchanged). Disc trace events showed `pos` actually advanced from 25.8 GB
+to 70 GB during that window — Pass 1 was 83 % through the disc, marking
+the post-bad-zone NonTrimmed via skip-forward exactly as designed. The
+display lied. Now consumers can show the truth.
+
+### Feature: `PatchOptions::reverse` for reverse-direction retry passes
+
+When set, `Disc::patch` walks bad ranges from highest LBA to lowest, and
+within each range reads sectors back-to-front. Hypothesis (per the live
+v0.13.14 test): drives that wedge after a forward read of a bad sector
+read fine when approached from end-of-disc backward — most of the
+post-bad-zone NonTrimmed range is actually clean data the drive could
+have read on Pass 1 had it not been wedged. autorip alternates F/R
+across retry passes (Pass 2 = reverse half-batch, Pass 3 = forward
+quarter-batch, ...).
+
+### Feature: `PatchOptions::wedged_threshold` early-exit
+
+When > 0, `Disc::patch` exits early if it sees this many consecutive
+read failures with zero successful reads in the same pass. Saves the
+wallclock budget for productive grinding when the drive has clearly
+wedged on the bad zone for this pass — a future pass with a different
+direction or block size may still recover. Reported via new
+`PatchResult::wedged_exit: bool`.
+
+### Trace: `patch_start` and `patch_done` events
+
+`freemkv::disc` target now emits `patch_start` (block_sectors, recovery,
+reverse, wedged_threshold, num_ranges) and `patch_done`
+(blocks_attempted, blocks_read_ok, blocks_read_failed, wedged_exit,
+halted, bytes_recovered) at Disc::patch boundaries.
+
+## 0.13.14 (2026-04-25)
+
+### Sync release — no functional changes in libfreemkv
+
+Bumped solely to satisfy the unified-versioning rule. The actual fix in
+this release is in autorip: the tracing subscriber now enables
+`freemkv::scsi=trace,freemkv::disc=trace` so the v0.13.13 instrumentation
+events actually surface in `/api/debug`. Without that filter override the
+trace events were silently dropped by the default `libfreemkv=warn` rule.
+
+## 0.13.13 (2026-04-25)
+
+### Telemetry: instrument the rip pipeline for in-flight diagnosis
+
+v0.13.12 shipped Fix 1+2+4 + cross-platform parity but a live test on Dune 2
+showed Pass 1 sat for 14 minutes with `bytes_good=0` while the inner loop
+appeared to iterate (the throttled `on_progress` log fired every 78s). The
+async fd_recovery design at §7 said each `execute()` call should bound at
+~1.5 s on poll timeout, with subsequent calls returning `DeviceNotFound` in
+microseconds until recovery completes. Observed reality contradicts that:
+each iteration takes ~60 s, not microseconds. Without trace-level telemetry
+at the SCSI + Disc::copy boundaries we can't diagnose where the time goes.
+
+This release adds the telemetry. No behavior change; instrumentation only.
+
+- New dep: `tracing = "0.1"`. Per project docs, debug/trace logging is permitted
+  in libfreemkv (the no-English rule applies to errors, not telemetry).
+  Consumers (autorip) wire a tracing subscriber and pipe events into the
+  JSONL debug log automatically.
+- `SgIoTransport::execute` (Linux): trace events at every state transition
+  (entry, recovery_swap_ok, recovery_pending, write_ok / write_err, poll_done,
+  timeout_spawn_recovery, scsi_err, read_err, ok). Each event includes the
+  opcode and elapsed timing. The bg recovery thread also traces close_ms +
+  open_ms so we can see if the kernel is hanging close+open.
+- `Disc::copy`: trace events at copy_start, outer_loop, region_enter, every
+  100 inner-loop iterations (iter_progress with pos / region_end / skip_size /
+  bytes_good / read_ok_count / read_err_count / last_read_ms /
+  copy_elapsed_ms), and copy_done.
+- All trace events use `target` strings `freemkv::scsi` and `freemkv::disc`
+  so consumers can filter by subsystem.
+
+### What this enables
+
+- A live rip will now produce a SCSI event stream visible at
+  `/api/debug?n=N&q=freemkv::scsi`. We can finally answer: "is the inner
+  loop iterating slowly because each call is slow, or fast with the bg
+  thread blocked?"
+- `bg_recovery_done` events with `close_ms` / `open_ms` reveal whether the
+  kernel really takes 60 s for close+open on a wedged Initio bridge.
+
+## 0.13.12 (2026-04-25)
+
+### Fix: delete stall guard from `Disc::copy` (RIP_DESIGN.md §6 Fix 1)
+
+The v0.13.9 stall guard at `disc/mod.rs` exited Pass 1 early when
+`bytes_good` was flat for `stall_secs` (default 120s). This violated the
+ddrescue model: Pass 1 must sweep end-to-end, marking failed reads
+NonTrimmed for Pass 2 retry. The guard caused Pass 1 to bail at 30% on
+Dune 2 with 56 GB still NonTried, leaving Pass 2 nothing useful to do.
+
+- Deleted the stall-guard state vars and the `if cur_good != ...
+  break 'outer;` block.
+- Deleted `CopyOptions::stall_secs` field — no longer wired.
+- Replaced the broken regression test
+  `test_disc_copy_stall_detection_triggers_skip_forward` with
+  `test_disc_copy_completes_full_disc_with_failing_reader` (asserts Pass 1
+  walks to end-of-disc with everything NonTrimmed when reads keep failing)
+  and added `test_disc_copy_halts_promptly_on_failing_reader` (halt flag
+  honored within 2s mid-skip-forward).
+
+### Fix: async SCSI transport recovery (RIP_DESIGN.md §6 Fix 2 / §7)
+
+`SgIoTransport::execute` (Linux) previously did close-in-background +
+synchronous open-on-main-thread on poll timeout. The kernel serialized
+the main-thread `open()` against the in-flight `close()` of the same
+`/dev/sg*`, blocking the rip thread up to ~60s per timeout.
+
+- Added `fd_recovery: Arc<AtomicI32>` field. On poll timeout, both
+  `close(old_fd)` AND `open(new_fd)` run in a background thread; the new
+  fd is published to `fd_recovery`. Returns Err immediately. Main thread
+  is never blocked beyond the `poll()` budget (~1.5 s).
+- Top of `execute()`: if `self.fd < 0`, swap from `fd_recovery`. If
+  recovery is also pending, return `DeviceNotFound` and let the caller's
+  retry loop come back later.
+- Drop drains any pending `fd_recovery` so the fd doesn't leak.
+- Stripped the v0.13.9 stall-guard narrative comment that justified
+  the deleted behavior.
+
+### Fix: cross-platform SCSI parity — Windows + macOS recovery (RIP_DESIGN.md §15.1)
+
+Per the platform parity rule (no stubs), Windows and macOS now have the
+same observable recovery contract as Linux:
+
+- `SptiTransport` (Windows): added `try_recover()` that calls
+  `CloseHandle` + `CreateFileW` synchronously after a failed
+  `DeviceIoControl`. Stripped English error string ("run as
+  administrator") from `open()`. Fixed the ms→s timeout truncation
+  (1500ms now rounds up to 2s, was 1s).
+- `MacScsiTransport` (macOS): added `try_recover()` that releases the
+  IOKit interface (`RELEASE_EXCLUSIVE` + `com_release`) and re-acquires
+  via the new `acquire_device_iface()` helper. Stores `bsd_name` so
+  recovery can re-call `find_scsi_service`.
+- All three platforms: top of `execute()` returns `DeviceNotFound`
+  immediately if a prior `try_recover()` left the transport in an
+  invalid state. Drop guards null'd-out interfaces.
+- Send is auto-derived on all three (i32 fd / isize HANDLE / IOKit
+  interface ref are Send-safe); explicit comments document the
+  intentional implicit Send and the absence of Sync.
+
+### Fix: instrument `Disc::patch` — diagnostic counters (RIP_DESIGN.md §6 Fix 4)
+
+`PatchResult` now reports `blocks_attempted`, `blocks_read_ok`,
+`blocks_read_failed`. Pass 2's "100 minutes recovered 0 bytes" mystery
+(Dune 2) becomes diagnosable from these counters: distinguish "drive
+returned Ok but write/record dropped data" from "every read was Err for
+the entire range" without instrumenting from outside the lib.
+
+### Fix: honor `PatchOptions::full_recovery`
+
+The field was previously read into `let _ = opts.full_recovery;` and
+ignored — `read_sectors(..., true)` was hardcoded. Now routed to
+`read_sectors(..., opts.full_recovery)`. Behavior unchanged for
+default callers (which pass `true`).
+
+### Doc: `CopyOptions::batch_sectors` accuracy
+
+Doc comment said "Defaults to 32 sectors (64 KB)". Updated to describe
+the actual production path: callers should resolve via
+`detect_max_batch_sectors(device_path)` (kernel-reported sysfs value,
+typically 60 sectors / ~120 KB on the BU40N). The 32-sector internal
+fallback is only reached when `batch_sectors=None AND skip_forward=true`.
+
+## 0.13.11 (2026-04-25)
+
+### Fix: revert SgIoTransport timeout path to keep transport alive
+
+v0.13.10 changed `SgIoTransport::execute` to set `fd = -1` on a poll
+timeout (no reopen on the main thread, since that would serialize
+against the spawned close()). The intent was to escape the 60-s
+blocking reopen.
+
+The cost was too high: a single transient poll timeout permanently
+killed the transport. Live test on Dune 2 (post-replug):
+- Pass 1 ran for **45 ms** then returned with 0 GB good and 80 GB
+  pending.
+- The first SCSI READ timed out, fd went to -1, every subsequent
+  read returned `DeviceNotFound` instantly, Disc::copy raced through
+  the entire disc skip-forwarding in milliseconds.
+- Pass 2 inherited the dead Drive and was equally useless.
+
+Revert: spawn close + reopen on main thread (the v0.13.5/8
+behavior). Yes the main-thread open() may block up to ~60 s while
+the kernel completes the abandoned command — but the v0.13.9
+`Disc::copy` stall guard already caps catastrophic stalls at 120 s
+of `bytes_good` non-advance. Net: per-timeout cost is ~60 s, but
+Pass 1 cleanly bails out within 120 s of any wedge, and Pass 2 has
+a working Drive to retry NonTrimmed ranges with `recovery=true` +
+30 s timeouts.
+
+The integration test for the stall guard
+(`test_disc_copy_stall_detection_triggers_skip_forward`) continues
+to pass — the guard fires regardless of which transport-recovery
+strategy is in play.
+
+## 0.13.10 (2026-04-25)
+
+### Version sync — no functional changes
+
+Sync bump for the autorip-side fix in 0.13.10 (Pass 1 batch reporting).
+
+## 0.13.9 (2026-04-25)
+
+### Fix: Disc::copy silent stall + SgIoTransport reopen-after-timeout serialization
+
+Two correlated fixes for a hang observed live on the LG BU40N during a
+v0.13.8 rip of Dune: Part Two. At ~30 % progress through Pass 1
+(disc → ISO), `bytes_good` froze for 10+ minutes with `errs=0`,
+no error surfaced, drive not wedged.
+
+Root cause: `SgIoTransport::execute` (linux.rs) attempted to recover from
+a `poll()` timeout by spawning a background `close()` of the old fd and
+opening a fresh `/dev/sg*` fd on the main thread. On Linux, opening the
+SAME device while a prior fd is mid-close serializes via the kernel's
+per-device state lock — so the fresh `open()` blocks for as long as the
+close does (until the kernel completes the in-flight CDB). This undid
+the userspace 1.5 s timeout: each timed-out read added 60+ s to the
+next iteration. From `Disc::copy`'s perspective, reads kept returning
+Err slowly, the skip-forward path advanced `pos` but never `bytes_good`.
+
+Fixes:
+- `SgIoTransport::execute` no longer reopens on timeout. Spawns the
+  close, sets `self.fd = -1`, returns Err immediately. Subsequent
+  calls fail with `DeviceNotFound` (already gated at line 248).
+  Caller (Drive) is invalidated until reopened. Pass 2's
+  `Disc::patch` would need a fresh Drive; that's a v0.14 follow-up.
+- `Disc::copy` adds a stall guard. New `CopyOptions::stall_secs:
+  Option<u64>` (default 120 s). If `bytes_good` doesn't advance for
+  the threshold, breaks the outer loop with `complete: false,
+  bytes_pending > 0` so the caller's retry path picks up.
+
+Tests: new `test_disc_copy_stall_detection_triggers_skip_forward` in
+`tests/integration_progress_and_halt.rs` proves the guard fires within
+the configured threshold.
+
+Other:
+- Cosmetic: warning text "rip thread did not drain within 35s" updated
+  to 60s (matches the v0.13.8 timeout bump).
+
+## 0.13.8 (2026-04-25)
+
+### Version sync — no functional changes
+
+Sync bump for the ecosystem. 0.13.8 carries autorip-side fixes:
+post-stop "error" leak (halt-aware Err handling in Pass 1/2+),
+60 s drain timeout, and a structural spawn_rip_thread helper.
+
+## 0.13.7 (2026-04-25)
+
+### Version sync — no functional changes
+
+Sync bump for the ecosystem. All four freemkv crates (libfreemkv,
+freemkv CLI, bdemu, autorip) always share a version number; 0.13.7
+carries an autorip-side fix (HTTP-spawned rip/scan threads now
+register for stop-drain).
+
+## 0.13.6 (2026-04-25)
+
+### Inline retry/reset stripped from `Drive::read`; `BytesRead` now emitted
+
+Two related changes that close the loop on the BU40N wedge work from
+0.13.1–0.13.4 and on the long-standing autorip "0 KB/s, 0%" UI bug.
+
+**`Drive::read` is now single-shot.** The phase 1 / 2 / 3 retry loop
+(reset → reopen → repeat) inside `Drive::read` is gone (~80 lines
+deleted). `recovery=true` only bumps the per-CDB timeout to 30 s;
+`recovery=false` keeps the 1.5 s timeout. On a failed read the
+function returns `Err(DiscRead)` immediately. Per the BU40N
+post-mortem, every USB / SCSI reset path tested in 0.13.1–0.13.3
+resets the bridge but not the drive firmware, and the inline
+reset+reopen *was* the wedge primitive itself — issuing it from
+inside `Drive::read` produced multi-minute hangs and made the wedge
+class harder to surface to the user. The correct retry layer is
+`Disc::patch`'s outer multi-pass loop, which is unaffected. A stuck
+drive now surfaces as a clean `DiscRead` to the caller, who can
+prompt physical replug.
+
+**SCSI reset surface trimmed.** `SgIoTransport::reset` (Linux) drops
+the `SG_SCSI_RESET` ioctl and the STOP / START UNIT escalation; it
+keeps the kernel `SG_IO` state flush plus `ALLOW MEDIUM REMOVAL`.
+`MacScsiTransport::reset` is removed entirely (was open + drop +
+sleep, no SCSI). The top-level `scsi::reset` /
+`scsi::reset_with_timeout` / `scsi::reset_blocking` family is
+removed — no callers remain after the `Drive::read` strip.
+
+**`EventKind::BytesRead` now emitted.** The variant was declared in
+0.13.0 but never fired. `DiscStream::fill_extents` now emits
+`BytesRead { bytes_read_total, total_extents_bytes }` after every
+successful sector read, so consumers in direct (no-mapfile) mode can
+drive a real-time progress bar without polling `output.bytes_written`.
+Multi-pass mode continues to use `Disc::copy`'s `on_progress`
+callback unchanged. Drives the autorip per-device live progress UI.
+
+`Drive::checked_sleep` is removed (only used by the recovery loop);
+`Drive::sleep_until_halted` is `#[cfg(test)]`-only; `Drive::emit` is
+retained because `BytesRead` uses it.
+
+### Tests
+- New `tests/integration_progress_and_halt.rs` (5 tests): `BytesRead`
+  emission, `Disc::copy` `on_progress` regression guard, halt aborts
+  copy, Drop safety, `FileSectorReader` round-trip.
+- 233 unit tests + 5 integration tests pass.
+
+### Net diff
+~80 lines deleted, ~20 added.
+
+### Version sync
+0.13.6 ecosystem release (libfreemkv + freemkv + bdemu + autorip all
+on 0.13.6).
+
+## 0.13.5 (2026-04-25)
+
+### Version sync — no functional changes
+Sync bump for the ecosystem. All four freemkv crates (libfreemkv,
+freemkv CLI, bdemu, autorip) always share a version number; 0.13.5
+carries autorip-side fixes (stop-is-reset, startup staging sweep).
+
+## 0.13.4 (2026-04-25)
+
+### Wedge recovery rolled back + sysfs identity fallback
+
+**What changed.** The in-library USB / SCSI wedge-recovery escalation
+added in 0.13.1 – 0.13.3 has been removed. `drive_has_disc` now returns
+the raw TUR result (or the `0xFF` poll-timeout wedge error) directly to
+the caller. `scsi::usb_reset()` / `usb_reset_with_timeout()` /
+`DEFAULT_USB_RESET_TIMEOUT_SECS` and the per-platform
+`SgIoTransport::usb_reset` / `MacScsiTransport::usb_reset` /
+`SptiTransport::usb_reset` are gone. All three platform backends pass
+transport errors through verbatim, keeping the public
+`list_drives` + `drive_has_disc` contract symmetric
+(Linux / macOS / Windows).
+
+**Why.** Production testing against the LG BU40N USB BD-RE (the drive
+that drove the whole 0.13.1–0.13.3 recovery push) showed:
+- `SG_SCSI_RESET`, `STOP UNIT` + `START UNIT`, and `USBDEVFS_RESET`
+  all succeed at the USB transport layer (kernel logs
+  `usb 3-2: reset high-speed USB device`, device re-authorises).
+- But the drive firmware *below* the USB bridge stays locked: no
+  LUN enumerates on the fresh `scsi_host`, TUR never succeeds,
+  `/dev/sg*` never reappears.
+- Also tried (outside the lib): `/sys/bus/usb/devices/<port>/authorized`
+  toggle, `usb-storage` driver unbind/rebind, forced SCSI host rescan.
+  All same outcome.
+
+Only physical unplug-replug (or host reboot) clears this wedge class.
+The library was logging 2-minute-per-tick escalation cycles for nothing,
+and consumers had no way to surface "drive needs physical intervention"
+to users because the escalation was masking the real failure. Upper
+layers (autorip, CLI) now see the wedge error directly and prompt the
+user.
+
+A breadcrumb in `scsi/linux.rs::drive_has_disc` catalogues every
+recovery method tried and points to git tag `v0.13.3` for the full
+implementation, in case a future hardware class is found where
+USB-layer recovery actually works.
+
+**New: sysfs-cached identity fallback (Linux).** `list_drives` now
+populates empty INQUIRY vendor/model/firmware fields from
+`/sys/class/scsi_generic/sgN/device/{vendor,model,rev}` — the kernel
+runs its own INQUIRY at device probe time and stashes the answer there,
+so even a mid-wedge INQUIRY still yields the UI a human-readable
+identity. The drive surface on screen doesn't suddenly go blank the
+moment the drive firmware locks up.
+
+## 0.13.3 (2026-04-24)
+
+### Bug fix — `drive_has_disc` wedge recovery was dead code for TUR errors
+
+The wedge-signature predicate introduced in 0.13.2 gated on
+`opcode == SCSI_INQUIRY (0x12)` — a holdover from when enumerate-time
+INQUIRY was the only path wedges surfaced on. `drive_has_disc` issues
+`TEST UNIT READY (0x00)`, so its wedge errors (`E4000: 0x00/0xff/0x00`)
+never matched the predicate and the SCSI-reset + USB-reset escalation
+never fired. Production result: the BU40N USB BD-RE stayed wedged
+indefinitely, with autorip logging `recovery exhausted` on the raw
+pass-through error while no recovery had actually been attempted.
+
+Fix: drop the opcode constraint. Status byte `0xFF` is synthesised by
+our own `execute()` path when `poll()` on the SG fd times out; it's
+the ground-truth wedge marker regardless of which opcode was in flight.
+Doc comments on `is_wedge_signature` and `WEDGE_STATUS_BYTE` updated
+accordingly. Linux-only — macOS / Windows use sense-key-based wedge
+detection and are unaffected.
+
+## 0.13.2 (2026-04-24)
+
+### Public discovery + presence APIs; SCSI/USB primitives no longer
+### exposed to consumer crates
+
+The autorip / freemkv-CLI side of the ecosystem was reimplementing
+hardware discovery (sysfs walking, SCSI type-5 filtering, sg-path
+construction) and SCSI recovery primitives in their own crates — a
+direct violation of the architectural rule that ALL hardware-aware
+code lives in libfreemkv. 0.13.2 closes that gap with two cheap public
+probes that absorb everything consumers were doing themselves, plus
+visibility tightening to make future violations a compile error.
+
+#### New public APIs
+
+- `pub struct DriveInfo { path, vendor, model, firmware }` — a single
+  enumerated optical drive's identity. Returned by `list_drives()`,
+  populated from a single SCSI INQUIRY at enumeration time. No
+  firmware reset, no `init`.
+- `pub fn list_drives() -> Vec<DriveInfo>` — one-shot enumeration
+  across Linux/macOS/Windows. Linux walks `/sys/class/scsi_generic/`
+  with the SCSI type-5 filter and `/dev/sg0..15` fallback; macOS
+  walks `/dev/disk0..15` with the INQUIRY peripheral-type-5 filter;
+  Windows iterates `CdRom0..15`. Cheap (~10 ms / drive); cache the
+  result and refresh on udev events.
+- `pub fn drive_has_disc(path: &Path) -> Result<bool>` — single TEST
+  UNIT READY. Returns `Ok(true)` when ready / `Ok(false)` on sense-key 2
+  ("medium not present") / `Err` only after recovery has been exhausted.
+  **Internal wedge recovery is hidden from callers** — when the kernel
+  returns the wedge-signature pattern (status 0xFF, no sense), this
+  function transparently escalates: SCSI bus reset → if still wedged →
+  USB device reset → retry TUR. Consumers never see the escalation.
+
+#### USB-layer reset, multi-platform
+
+`USBDEVFS_RESET` (Linux) is the only thing that recovers a kernel-
+level USB Mass Storage wedge — software equivalent of unplug-replug.
+Now wired for all three OSes:
+
+- **Linux**: `USBDEVFS_RESET` ioctl on `/dev/bus/usb/BBB/DDD`. Resolves
+  sg → USB device via sysfs walk (`busnum`/`devnum` parents).
+- **macOS**: `IOUSBDeviceInterface::ResetDevice()`. Walks IORegistry
+  parents from the SCSI service to the USB device, queries the IOKit
+  USB plugin, calls ResetDevice.
+- **Windows**: existing `IOCTL_STORAGE_RESET_DEVICE` covers both SCSI
+  and USB layers via storport, so `usb_reset` returns `DeviceNotFound`
+  by design — the recovery escalation in `drive_has_disc` falls
+  through cleanly. (See the `windows::usb_reset` doc comment for
+  why a separate cycle-port IOCTL isn't needed on Windows.)
+
+All wrapped in a thread + `mpsc::recv_timeout` so a kernel ioctl that
+hangs forever can't lock up the caller (the inner thread leaks one OS
+thread per hard wedge — acceptable for a daemon that recovers vs. one
+that wedges the whole poll loop).
+
+#### Visibility tightening (architectural enforcement)
+
+These were `pub` in 0.13.1; consumer crates could (and did) call them
+directly, leaking SCSI knowledge across the lib boundary:
+
+- `scsi::reset` → `pub(crate)`
+- `scsi::reset_with_timeout` → `pub(crate)`
+- `scsi::usb_reset` → `pub(crate)`
+- `scsi::usb_reset_with_timeout` → `pub(crate)`
+- `DEFAULT_RESET_TIMEOUT_SECS` / `DEFAULT_USB_RESET_TIMEOUT_SECS` →
+  `pub(crate)`
+
+Consumers now reach recovery exclusively through `drive_has_disc`,
+which folds the escalation in. **Compile-time guarantee** that no
+future autorip/CLI/bdemu commit can reintroduce direct SCSI access.
+
+#### Why this design
+
+`Drive::open(path)` runs a ~2 s firmware-reset preamble + identify
+sequence; suitable for ripping but wasteful for a poll loop probing
+"is there a disc?". Pre-0.13.2 autorip called `Drive::open` 4 × every
+5 s = ~17 000 speculative SCSI sessions/day, hammering the drives
+between actual rips. The wedge in production at 23:51 UTC was
+triggered by exactly this hot-loop pattern. With `drive_has_disc`,
+the same poll cadence costs ~50 ms / drive (one TUR) — 40× cheaper
+and side-effect-free on a healthy drive.
+
+#### Tests
+
+- 233 lib tests pass (no change in count; APIs covered indirectly via
+  the existing transport tests + a new `device_key` test on the
+  autorip side).
+- `cargo clippy --all-targets -D warnings` clean across Linux/macOS.
+
+## 0.13.1 (2026-04-24)
+
+### `scsi::reset()` now has a hard wallclock timeout
+
+Production incident on a wedged BU40N USB drive: autorip's poll loop
+called `scsi::reset()` and the call hung for 60+ seconds before the
+operator manually intervened. Root cause: the Linux `SG_SCSI_RESET`
+ioctl can block indefinitely when the kernel SCSI subsystem is waiting
+on a bus-wedged device that will never ack — there's no kernel-side
+timeout on this ioctl. Without an outer wallclock bound the caller's
+thread is stuck in the kernel until the device unwedges (which, for a
+permanently-dead USB target, may be never).
+
+`scsi::reset()` is now a wrapper that runs the platform-specific reset
+on a detached worker thread and bounds the caller's wait via
+`mpsc::recv_timeout(DEFAULT_RESET_TIMEOUT_SECS)` (30 s). Returns
+`DeviceResetFailed` on timeout. The worker thread keeps running until
+the kernel eventually unblocks (we can't cancel a Linux ioctl from
+userspace) — this leaks one OS thread per hard wedge, an acceptable
+cost for a daemon that recovers vs. one that hangs.
+
+- New `pub const DEFAULT_RESET_TIMEOUT_SECS: u64 = 30;`
+- New `pub fn reset_with_timeout(device, Duration) -> Result<()>` for
+  callers that want a different bound.
+- Existing `pub fn reset(device) -> Result<()>` keeps the same
+  signature; behaviour change is the timeout, not the API.
+
+### Follow-up flagged
+
+`SG_SCSI_RESET` only resets at the SCSI layer. For USB-attached drives
+(the BU40N case), the wedge is often in the USB Mass Storage layer
+*below* SCSI — `SG_SCSI_RESET` doesn't help. The proper escalation is
+`USBDEVFS_RESET` (the `usbreset.c` ioctl), which re-enumerates the
+device at the USB layer. Tracked for 0.13.2: a `scsi::usb_reset(path)`
+that resolves sg → USB device and issues `USBDEVFS_RESET`. That would
+have recovered tonight's BU40N without operator intervention.
+
+## 0.13.0 (2026-04-24)
+
+### Zero English in library — typed variants for every error path
+
+Audit pass against the `project docs` rule (no English text in library code).
+Found nine call sites that violated the contract by stuffing English into
+`io::Error::new(kind, "…")` or by abusing `Error::DeviceNotFound { path }`
+as a free-form description field. Each is now a typed variant with
+structured fields; the CLI / autorip translates to localized text.
+
+New `Error` variants and codes:
+
+- `ScsiInterfaceUnavailable { path }` — `E1004` (macOS
+  `SCSITaskDeviceInterface` couldn't be obtained)
+- `DeviceLocked { path, kr }` — `E1005` (replaces an English
+  "exclusive access denied. Try: diskutil unmountDisk" message)
+- `IoKitPluginFailed { path, kr }` — `E1006`
+- `UnsupportedPlatform { target }` — `E2003` (built on an OS without an
+  SCSI backend)
+- `PlatformNotImplemented { platform }` — `E2004` (replaces the
+  `product_revision: "Renesas not yet implemented"` string-stuffing in
+  `drive::mod`)
+- `MapfileInvalid { kind }` — `E6011` (ddrescue mapfile parse, with a
+  stable `&'static str` kind: `"status_char"` or `"hex"`)
+- `DiscUrlNotDirect` — `E9009` (replaces the full English sentence
+  `"Use Drive::open() + Disc::scan() + DiscStream::new() for disc sources"`
+  that `mux::input(disc://…)` returned to callers)
+
+Migrated call sites:
+
+- `mux/resolve.rs` — disc URL → `DiscUrlNotDirect`; the four
+  `format!("m2ts://…")` / `format!("mkv://…")` IO error wraps now
+  propagate the inner `io::Error` unchanged (the URL-prefix wrap added
+  no semantic information).
+- `mux/iso.rs` — same `format!("iso://…")` wrap dropped.
+- `sector.rs` — image-too-large now uses the existing `IsoTooLarge`
+  variant instead of `format!("…image too large, max ~8 TB")`.
+- `disc/mapfile.rs` — bad-status-char and bad-hex parser errors now use
+  `MapfileInvalid { kind }`.
+- `scsi/mod.rs` — unsupported-platform path uses `UnsupportedPlatform`.
+- `scsi/macos.rs` — IOKit plugin failure → `IoKitPluginFailed`,
+  `SCSITaskDeviceInterface` missing → `ScsiInterfaceUnavailable`,
+  exclusive-access denied → `DeviceLocked` with the IOReturn code as a
+  structured `kr` field. The `find_scsi_service` four-stage failure path
+  is now a single `DeviceNotFound { path }` (none of the prior
+  per-stage English descriptions were user-actionable individually).
+- `drive/mod.rs` — Renesas platform → `PlatformNotImplemented`.
+
+### Stripped English from `labels` module
+
+`labels::apply()` previously pushed `"Commentary"`, `"Descriptive Audio"`,
+`"Score"`, `"IME"`, and `" (Secondary)"` directly into
+`AudioStream.label`. Those English strings then leaked into MKV titles
+and into autorip's UI. The data was already structured upstream
+(`LabelPurpose` enum on `StreamLabel`); the lib was downcasting it for
+the caller's convenience.
+
+- `AudioStream` gains `purpose: LabelPurpose` (re-exported from
+  `crate::disc` next to the struct, alongside `LabelQualifier`).
+- `SubtitleStream` gains `qualifier: LabelQualifier`.
+- `apply()` writes structured fields, never English. `label` keeps
+  codec-formatting only (`"Dolby TrueHD 5.1"`).
+- `generate_audio_label` drops the `" (Secondary)"` suffix; `secondary`
+  is already a `bool` field, callers render it.
+- `generate_video_label` drops the `"Secondary Video"` fallback.
+  `"Dolby Vision EL"` kept (brand identifier, not translatable).
+
+### API hygiene
+
+- **mux module visibility tightened**. `pub mod ebml`, `m2ts`, `mkv`,
+  `network`, `null`, `ps`, `stdio`, `ts`, `tsmux` are now `pub(crate)`.
+  Their *types* are still re-exported from `lib.rs` — the modules
+  themselves were leaking low-level EBML primitives, TS muxer
+  internals, and network/stdio implementations that no external caller
+  used. `mux::codec`, `mux::disc`, `mux::iso`, `mux::resolve`, and
+  `mux::meta` stay public (genuine APIs).
+- **Stream trait rustdoc**. The keystone PES `Stream` trait (in
+  `pes.rs`) had per-method docs but no trait-level doc. Now explains
+  read-vs-write split, error contracts, the role of `info()` /
+  `codec_private()` / `headers_ready()`.
+- **lib.rs re-export sections**. Eight grouped sections with a
+  paragraph each (Drive lifecycle, Errors, Decryption, Disc structure,
+  Streams, Lower-level surfaces) so `cargo doc` tells callers when to
+  reach for what.
+- **Dropped `ScanOptions::with_keydb()`**. The `_with_X` constructor
+  pattern was banned by `project docs` (one method per action). Use the
+  struct literal: `ScanOptions { keydb_path: Some(p.into()) }`. Five
+  external call sites (autorip ×3, freemkv CLI ×3) and three test
+  fixtures migrated.
+- **`pid_index` allocation documented**. The `TsDemuxer::new` flat
+  lookup table was flagged by audit as "unbounded for adversarial
+  PIDs"; on closer reading it's bounded by `u16::MAX × 2 bytes ≈ 128 KB`.
+  Doc comment now states the bound explicitly so future contributors
+  don't re-flag it.
+
+### Dead-code sweep
+
+Pre-PES-rewrite leftovers that were `pub` but unreachable:
+
+- Deleted `mux/lookahead.rs` entirely (orphan file — never had a `mod`
+  declaration; only used by its own tests).
+- Deleted `mux/tsreader.rs` (`TsDemuxReader` struct + four methods,
+  used nowhere).
+- Deleted `mux::ebml::write_int`, `read_vint`, `SEEK_HEAD`, `SEEK`,
+  `SEEK_ID`, `SEEK_POSITION` (unused).
+- Deleted `mux::ts::scan_first_pts`, `scan_last_pts`, `scan_duration`,
+  `SCAN_HEAD_SIZE`, `SCAN_TAIL_SIZE`, `take_remainder`, `set_remainder`
+  (unused since the v0.10 PES rewrite).
+- Deleted `MkvMuxer::codec_private_slots` /
+  `codec_private_filled` fields and `fill_codec_private` method —
+  deferred-codecPrivate path was never exercised once codec_privates
+  flowed through `DiscTitle`.
+
+`cargo clippy --all-targets -- -D warnings` is clean.
+
+### Tests
+
+- New `error::tests` module — code distinctness, Display has no English
+  words, `io::ErrorKind` mapping for every new variant.
+- 233 lib tests (was 230), all green.
+
+### Breaking changes
+
+Source-compatible for callers who use `Error` opaquely (handle
+`Result<T, Error>` and `error.code()` only). The following are breaking:
+
+- `ScanOptions::with_keydb()` removed — use struct literal.
+- `mux::ebml`, `mux::mkv`, `mux::ts`, etc. modules no longer accessible
+  externally — use the re-exported types from the crate root instead.
+- `AudioStream` and `SubtitleStream` gained required fields (`purpose`,
+  `qualifier`). Construction-by-struct-literal must include them.
+- `Error::UnsupportedDrive { product_revision: "Renesas not yet
+  implemented" }` no longer produced — match `PlatformNotImplemented`.
+
+### Magic-number policy
+
+Per the v0.13 audit directive: new code in this release uses named
+documented constants (e.g. `POLL_INTERVAL_SECS` in autorip, the wedge
+signature literals in `ripper.rs`, the `BD_TS_PID_SPACE` floor in
+`ts.rs`'s table allocation). A comprehensive retrofit of pre-existing
+magic numbers across the older codebase is queued as follow-up work for
+0.13.1+ — too large to absorb into this release without scope creep.
+
+## 0.12.0 (2026-04-24)
+
+### Rust 2024 edition migration
+- Bumped `edition = "2024"`. Required code changes:
+  - FFI declarations in `src/scsi/macos.rs` wrapped in `unsafe extern "C" { … }` per the 2024 FFI safety rules.
+  - `unsafe_op_in_unsafe_fn` lint: `vtable_fn()` body now has an explicit `unsafe { … }` block rather than relying on implicit unsafe of the containing `unsafe fn`.
+  - Match-ergonomics: removed redundant `ref`/`ref mut` bindings in `mux/meta.rs`, `mux/mkvstream.rs`, `mux/network.rs`, `mux/stdio.rs` — 2024 tightens "cannot explicitly borrow within an implicitly-borrowing pattern."
+- No behavior change. MSRV stays at 1.86.
+
+### Minor / version sync
+- Part of the 0.12.0 ecosystem release. The autorip-side fixes (progress regressions, UI redesign, regression-guard tests) drove the minor bump.
+
+## 0.11.22 (2026-04-24)
+
+### Version sync — no functional changes
+Part of the 0.11.22 ecosystem release. autorip 0.11.22 ships full multi-pass UI (bad-range viz, live mapfile stats, Recovery settings); the library API is unchanged from 0.11.21.
+
+## 0.11.21 (2026-04-24)
+
+### Multi-pass rip architecture — disc → ISO → patch → ISO
+
+New primitives for two-stage rip: fast forward pass with zero-fill on failures, then targeted retries of bad ranges. Keeps the library API stream-based; the multi-pass model lives entirely in caller-orchestrated function composition.
+
+- **New `Disc::copy(reader, path, &CopyOptions)`** replaces the positional-arg version. Always produces a ddrescue-format mapfile at `path + ".mapfile"` as a side-effect. With `skip_on_error=true` + `skip_forward=true`, does ddrescue-style fast sweep: 64 KB block reads, exponential skip-forward (256 KB → cap at 1% of disc) on failure, zero-fill bad blocks, record ranges in the mapfile. With defaults (both false), matches pre-0.11.21 behavior — uses drive-level recovery, aborts on bad sector. Mapfile is produced either way.
+- **New `Disc::patch(reader, path, &PatchOptions)`** — idempotent retry pass. Reads the mapfile, re-reads every non-`+` range with full drive recovery enabled, writes successful bytes back into the ISO at exact offsets, updates mapfile. Call N times for N retry attempts.
+- **New `disc::mapfile` module** — ddrescue-compatible plain-text format. Crash-safe (flushes on every `record()`), greppable, human-editable, tool-interoperable. Status chars match ddrescue: `?` non-tried · `*` non-trimmed · `/` non-scraped · `-` unreadable · `+` finished.
+- **Re-exports:** `FileSectorReader` from the crate root for ISO readers.
+
+### Breaking changes
+- `Disc::copy`'s signature changes from positional args (`decrypt, resume, batch, on_progress`) to `CopyOptions`. Previous callers must migrate. `freemkv` CLI updated in lockstep.
+
+### Version sync
+- Part of the 0.11.21 ecosystem release (libfreemkv + freemkv + bdemu + autorip all on 0.11.21).
+
+## 0.11.18 (2026-04-24)
+
+### DiscStream halt flag — Stop works during dense bad-sector regions
+
+`DiscStream::fill_extents` loops internally when the demuxer hasn't accumulated enough data to emit a PES frame — during a dense bad-sector run, that loop can spend many minutes shrinking batch sizes and zero-filling sectors without ever returning to the outer read() call. Without an internal halt check, the caller's Stop request goes unserviced until the demuxer eventually emits a frame, which may be very far away.
+
+- **`DiscStream::set_halt(Arc<AtomicBool>)`** — share a halt flag with the stream. Typically wired to `Drive::halt_flag()` so Stop propagates across both the drive's recovery phases and the stream's sector processing.
+- **`fill_extents()` checks the halt flag** at the top of every retry iteration (before each attempt at every size level). Raising the flag aborts within one read round-trip — at most the current SCSI command's timeout.
+- Returns `Err(Error::Halted)` (E6010) so the outer rip pipeline terminates cleanly.
+
+No behavior change for callers that don't call `set_halt`. Unblocks the architectural fix for the "Stop doesn't stop" bug observed on a damaged UHD disc where the stream was stuck in a 12+ hour bad-sector grind.
+
+## 0.11.17 (2026-04-23)
+
+### Adaptive batch sizer in DiscStream — no more per-sector descent
+
+Rip recovery rewritten. The old binary-search-per-bad-sector model paid the full descent (batch → half → quarter → … → single) for every bad sector in a region. On a damaged disc with 600 consecutive bad sectors this took 12+ hours. The new algorithm pays the descent once, remembers the working size, and ramps back up only after a sustained clean streak.
+
+- **`BatchSizeChanged { new_size, reason }` event** — fires on shrink (read failed) and probe-up (clean streak threshold hit). Consumers use this to distinguish a "recovering" rip from a normal one.
+- **Removed `BinarySearch` and `SectorRecovered` emissions from DiscStream** — no longer produced by the rip path. `SectorRecovered` still fires from `Drive::read`'s multi-phase recovery (unused by rips today, but kept for scan/other callers).
+- **Removed `read_with_binary_search` and the 3×5s light-recovery loop** — no retry loops, no sleeps. One 5s attempt per read. On size-1 failure, skip (zero-fill) or error.
+- **Probe-up threshold: 100 MiB (51,200 sectors) of clean reading at current size** before doubling toward preferred. Ramp 1 → preferred on good reading takes ~100 seconds for a typical BD — trivial vs. rip duration, conservative enough that a single lucky sector in a marginal zone can't trigger a premature probe.
+- **Bad-region math**: ~600 consecutive bad sectors now complete in ~50 min (600 × 5s) instead of ~12h. The descent is O(log preferred) one time, not per sector.
+
+### macOS
+
+- Fix new clippy lint (`manual_c_str_literals`) in `scsi/macos.rs`.
+
+## 0.11.16 (2026-04-21)
+
+### API cleanup — one method per action
+- **SectorReader::read_sectors(lba, count, buf, recovery)** — single method with `recovery: bool`. Removes `read_sectors_recover()`.
+- **parser_for_codec(codec, codec_data)** — single constructor. Removes `parser_for_codec_with_data()`.
+- **DvdSubParser::new(codec_data)** — single constructor. Removes `with_codec_data()`.
+- **MkvMuxer::new(writer, tracks, title, duration, chapters)** — single constructor. Removes `new_with_chapters()`.
+
+## 0.11.15 (2026-04-21)
+
+### Lint cleanup
+- Fix all `cargo fmt` and `cargo clippy -D warnings` across codebase.
+- Remove unused imports, dead code, collapsible if-statements, div_ceil reimplementation.
+
+## 0.11.14 (2026-04-21)
+
+### Audit fixes: read recovery, verify, SCSI
+- **Fix: trailing sectors at extent boundaries** — extents with sector_count not divisible by 3 no longer drop 1-2 trailing sectors. decrypt_sectors() safely skips partial AACS units.
+- **Fix: verify_title stop support** — progress callback now returns bool. Return false to stop verification early instead of running to completion.
+- **Fix: O_CLOEXEC on all SCSI fd opens** — prevents fd leak to child processes.
+- **Fix: SCSI sense descriptor format** — correctly detect response code 0x72/0x73 (descriptor format) and extract sense key from byte 1 instead of byte 2.
+- **Fix: DecryptFailed on missing unit key** — decrypt_sectors() returns Err(DecryptFailed) instead of silently using a zero key.
+
+## 0.11.13 (2026-04-21)
+
+### Fix: all rip reads use fast timeout
+- Initial batch read changed from full Drive::read() recovery to fast 5s timeout. Binary search starts immediately on failure instead of after 10 minutes of retries.
+- Max 15 seconds per bad sector (3 x 5s attempts). Max 23 seconds per batch with 1 bad sector.
+
+## 0.11.12 (2026-04-21)
+
+### Drive halt + sector events + light recovery
+- **Drive.halt()** — AtomicBool flag checked between retry phases. Max 30s to stop.
+- **Drive.on_event()** — callback for ReadError, Retry, SpeedChange, SectorRecovered events.
+- **Error::Halted (E6010)** — distinct from DiscRead, indicates intentional stop.
+- **Binary search light recovery** — single sectors get 3 attempts x 5s (15s max) instead of full 10-min Drive::read() recovery. Marginal disc zones complete in minutes not hours.
+- **DiscStream.on_event()** — BinarySearch, SectorRecovered, SectorSkipped events.
+
+## 0.11.11 (2026-04-20)
+
+### Binary search error recovery
+- **fill_extents binary search** — when a batch read fails, binary search to isolate the failing sector(s). Good sectors read in sub-batches at full speed. Only truly bad sectors get individual recovery. 60-sector batch with 1 bad sector: ~5 seconds instead of 10+ minutes.
+
+## 0.11.10 (2026-04-20)
+
+### Skip errors + clean verify API
+- **DiscStream.skip_errors** — when true, zero-fills unreadable sectors and continues instead of aborting. Caller sets based on user preference.
+- **read_sectors_recover(recovery: bool)** — single API for recovery vs fast reads. Replaces separate read_sectors_fast method.
+
+## 0.11.9 (2026-04-20)
+
+### Fast verify reads
+- **read_sectors_fast()** — single-attempt 5s timeout SCSI read for verify. No recovery loop. Bad sectors detected in seconds instead of 10+ minutes.
+- **SectorReader trait** — added read_sectors_fast() with default fallback to read_sectors().
+
+## 0.11.8 (2026-04-20)
+
+### Disc verify
+- **verify::verify_title()** — sector-by-sector health check. Classifies sectors as Good/Slow/Recovered/Bad. Progress callback, chapter mapping, sector ranges.
+
+## 0.11.7 (2026-04-19)
+
+### TrueHD parser rewrite
+- **12-bit length mask** — access unit length is lower 12 bits of first 2 bytes, not full 16. Upper 4 bits are parity nibble. Wrong mask caused misaligned frame splits.
+- **AC-3 frame skipping** — BD-TS TrueHD PES contains interleaved AC-3 frames (same PID). Parser now detects AC-3 sync word (0x0B77) and skips those frames.
+- **Cross-PES buffering** — access units that span PES packet boundaries are correctly reassembled.
+- **Per-unit timestamps** — each access unit gets incrementing PTS (1/1200th second apart) instead of all units in one PES sharing the same timestamp.
+- **Major sync detection** — keyframe flag set when access unit contains MLP major sync (0xF8726FBA).
+- Result: zero TrueHD decode errors on UHD and BD (was ~19 per 30 seconds).
+
+## 0.11.6 (2026-04-18)
+
+### TrueHD fix (incomplete)
+- Initial attempt at TrueHD header stripping — wrong approach, superseded by 0.11.7.
+
+## 0.11.5 (2026-04-18)
+
+### MKV container fixes — Jellyfin/player compatibility
+- **Timestamp normalization** — MKV and M2TS output starts at 0.000s instead of raw disc PTS offset. Fixes playback failures in Jellyfin and other players.
+- **DefaultDuration** — correct frame rate written to MKV track header. Fixes wrong avg_frame_rate (was 293/12, now 24000/1001).
+- **HDR Colour metadata** — MatrixCoefficients, TransferCharacteristics, Primaries, Range written to MKV video track. Enables HDR tone mapping in players.
+- **DisplayWidth/DisplayHeight** — aspect ratio fields in MKV video track.
+- **Chapters (Blu-ray)** — accept mark_type 0 as chapter entry (was filtering to type 1 only, which no disc uses).
+- **Chapters (DVD)** — extract chapter timestamps from PGC program map + cell durations.
+- **Default disposition** — only first video and first audio track marked default. Fixes wrong auto-selection in players.
+
+## 0.11.3 (2026-04-18)
+
+### Unified versioning
+- All freemkv repos now share the same version number. No functional changes from 0.10.10.
+
+## 0.10.10 (2026-04-18)
+
+### Dual-layer disc fix
+- **UDF extent allocation** — use actual UDF allocation descriptors (`file_extents()`) instead of assuming m2ts files are contiguous from `file_start_lba`. Dual-layer UHD discs split large files across many extents (~1 GB each). The old single-extent assumption truncated rips at ~37% on affected discs.
+- **Read error propagation** — `fill_extents()` returns `io::Result<bool>` so SCSI read errors propagate to the caller instead of being silently treated as EOF.
+
+## 0.10.9 (2026-04-17)
+
+### Fast disc identification
+- **Disc::identify()** — reads UDF filesystem only (name, format, layers, encrypted). ~3s on USB vs 18s for full scan. No AACS handshake or playlist parsing.
+- **KEYDB path fix** — added `~/.config/freemkv/keydb.cfg` to search paths. Fixes silent rip hang when KEYDB exists but isn't found by `resolve_keydb()`.
+
+## 0.10.8 (2026-04-17)
+
+### Buffered UDF reads
+- **BufferedSectorReader** — prefetches batch sectors on single-sector reads. USB drives have ~500ms per SCSI command; this eliminates scan hangs.
+- **Metadata partition pre-read** — loads entire UDF metadata partition into memory after initial parse.
+- Scan time reduced from 10+ minutes to ~18 seconds on USB.
+
+## 0.10.7 (2026-04-17)
+
+### DiscStream::new()
+- Replaced open_drive(), open_iso(), from_reader() with single new() constructor
+- Stream accepts ContentFormat and sets up demuxer internally
+- Removed disc:// case from input() — callers use primitives directly
+
+## 0.10.6 (2026-04-16)
+
+### Docker compatibility
+- **Drive discovery** — removed sysfs check that blocked detection inside Docker containers. Device nodes are sufficient; INQUIRY command validates the device is an optical drive.
+
+## 0.10.5 (2026-04-16)
+
+### Audio parser buffering
+- **AC3** — buffer across PES boundaries with frame size from fscod/frmsizecod table. Eliminates all AC3 decode errors on BD and UHD.
+- **DTS** — buffer with core sync detection + frame size from header. DTS-HD extension frames handled correctly.
+- **TrueHD** — buffer with unit length field parsing. Incomplete units held for next PES.
+- All audio parsers now emit complete frames only. When PES boundaries align (normal case), buffering is a no-op.
+
 ## 0.10.4 (2026-04-16)
 
 ### CSS decryption — full key hierarchy

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "libfreemkv"
-version = "0.10.4"
-edition = "2021"
+version = "0.13.17"
+edition = "2024"
 rust-version = "1.86"
 license = "AGPL-3.0-only"
 description = "Open source raw disc access library for optical drives"
@@ -24,6 +24,10 @@ rand = "0.8"
 cmac = "0.7"
 zip = { version = "2", default-features = false, features = ["deflate"] }
 base64 = "0.22.1"
+# Trace-level instrumentation for Disc::copy + SgIoTransport::execute. Permitted
+# under project docs ("Acceptable strings: debug/trace logging"). Consumers (autorip)
+# wire a tracing subscriber and pipe events into the JSONL debug log.
+tracing = "0.1"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libc = "0.2"
@@ -31,6 +35,9 @@ libc = "0.2"
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"
 
+[dev-dependencies]
+tempfile = "3"
+
 [[bench]]
 name = "sgio_read"
 harness = false

FEATURES.md

@@ -1,6 +1,6 @@
 # libfreemkv — Feature List
 
-## v0.7.1 (current)
+## v0.10.10 (current)
 
 ### Done
 - [x] Drive access: open, identify, unlock, firmware upload, speed calibration, eject
@@ -11,13 +11,18 @@
 - [x] CLPI clip info parser (EP map, sector extents)
 - [x] AACS 1.0 decryption (4 VUK paths: KEYDB, media key, processing key, device key)
 - [x] AACS 2.0 SCSI handshake (P-256/SHA-256 ECDH, bus decryption, read data key)
+- [x] DVD IFO parser (VMG, VTS, PGC chains, cell addresses)
+- [x] DVD CSS decryption (bus auth, disc key via player keys, title key, sector descramble)
+- [x] CSS Stevenson plaintext attack for ISO key recovery
+- [x] MPEG-2 PS demuxer (DVD Program Stream with PES extraction)
+- [x] MPEG-2 video codec parser (sequence header, quantizer matrices, keyframe detection)
 - [x] KEYDB.cfg download, verify, save (raw TCP, zero HTTP deps)
 - [x] Content reading with adaptive batch sizing, error recovery, 12+ MB/s
 - [x] Stream labels: 5 BD-J format parsers (Paramount, Criterion, Pixelogic, CTRM, Deluxe)
-- [x] MKV muxer: 8 codec parsers (H.264, HEVC, AC-3, DTS, TrueHD, PGS, VC-1, LPCM)
+- [x] MKV muxer: 14 codec parsers (H.264, HEVC, MPEG-2, AC-3, DTS, TrueHD, PGS, DVD Sub, VC-1, LPCM, +4 more)
 - [x] SectorReader trait: decouples disc scanning from SCSI
 - [x] 7 stream types: Disc, ISO, MKV, M2TS, Network, Stdio, Null
-- [x] IOStream trait with URL-based resolver (scheme://path)
+- [x] PES pipeline with unified Stream trait (any source → any dest)
 - [x] FMKV metadata header for M2TS and network streams
 - [x] Numeric error codes only (no English text in library)
 - [x] Event system for progress callbacks
@@ -25,6 +30,5 @@
 ### Planned
 - [ ] Windows testing on real hardware
 - [ ] Pioneer Renesas platform support (48 drives, need GET_CONFIG 010C)
-- [ ] DVD CSS decryption
 - [ ] TranscodeStream (ffmpeg integration)
 - [ ] ISO write with BD-compliant UDF structure

Makefile

@@ -0,0 +1,20 @@
+# libfreemkv — local dev helper.
+# Mirrors the cross-crate scripts in (internal)/scripts/test-all.sh
+# but scoped to this single crate.
+
+.PHONY: test build check ci clean
+
+test:
+	cargo test --tests
+
+build:
+	cargo build --release
+
+check:
+	cargo fmt --check
+	cargo clippy --all-targets -- -D warnings
+
+ci: check build test
+
+clean:
+	cargo clean

README.md

@@ -4,7 +4,7 @@
 
 # libfreemkv
 
-Rust library for 4K UHD / Blu-ray optical drives. Drive access, disc scanning, stream labels, AACS decryption, KEYDB updates, and content reading in one crate. Bundled drive profiles — no external files needed.
+Rust library for 4K UHD / Blu-ray / DVD optical drives. Drive access, disc scanning, stream labels, AACS decryption, CSS decryption, KEYDB updates, and content reading in one crate. Bundled drive profiles — no external files needed.
 
 **12+ MB/s** sustained read speeds on BD. Full init: unlock, firmware upload, speed calibration — all from pure Rust.
 
@@ -18,7 +18,7 @@ Part of the [freemkv](https://github.com/freemkv) project.
 
 ```toml
 [dependencies]
-libfreemkv = "0.10"
+libfreemkv = "0.13"
 ```
 
 ## Quick Start
@@ -51,6 +51,31 @@ while let Ok(Some(frame)) = input.read() {
 output.finish()?;
 ```
 
+### Multi-pass recovery rip
+
+For damaged discs, the library offers a two-stage rip model: fast sweep with zero-fill and a ddrescue-format mapfile, then targeted retry of bad ranges. See [`docs/rip-recovery.md`](docs/rip-recovery.md) for the full architecture.
+
+```rust
+use libfreemkv::disc::{CopyOptions, PatchOptions};
+
+// Pass 1: disc → ISO. Fast 64 KB reads, skip-forward on failure,
+// zero-fill bad blocks, write a sidecar .mapfile.
+let mut result = disc.copy(
+    &mut drive,
+    Path::new("disc.iso"),
+    &CopyOptions { skip_on_error: true, skip_forward: true, ..Default::default() },
+)?;
+
+// Pass 2..N: retry bad ranges with full drive recovery.
+// Idempotent — call as many times as you want.
+while result.bytes_unreadable + result.bytes_pending > 0 {
+    let pr = disc.patch(&mut drive, Path::new("disc.iso"), &PatchOptions::default())?;
+    if pr.bytes_recovered_this_pass == 0 { break; }
+}
+
+// Then mux from the ISO via the normal stream pipeline (no drive involvement).
+```
+
 ## What It Does
 
 - **Drive access** — open, identify, unlock, firmware upload, speed calibration, eject
@@ -59,7 +84,7 @@ output.finish()?;
 - **Stream labels** — 5 BD-J format parsers (Paramount, Criterion, Pixelogic, CTRM, Deluxe)
 - **AACS decryption** — transparent key resolution and content decrypt (1.0 + 2.0 bus decryption)
 - **KEYDB updates** — download, verify, save from any HTTP URL (zero deps, raw TCP)
-- **Content reading** — adaptive batch reads with automatic decryption and error recovery
+- **Content reading** — adaptive batch reads with automatic decryption
 - **Stream I/O** — unified stream pipeline for reading and writing any format
 
 ### Streams
@@ -67,21 +92,21 @@ output.finish()?;
 | Stream | Input | Output | Transport |
 |--------|-------|--------|-----------|
 | DiscStream | Yes | -- | Optical drive via SCSI |
-| IsoStream | Yes | Yes | Blu-ray ISO image file |
+| IsoStream | Yes | -- | Blu-ray ISO image file (read via stream pipeline; written via `Disc::copy()`) |
 | MkvStream | Yes | Yes | Matroska container |
 | M2tsStream | Yes | Yes | BD transport stream with FMKV metadata header |
 | NetworkStream | Yes (listen) | Yes (connect) | TCP with FMKV metadata header |
 | StdioStream | Yes (stdin) | Yes (stdout) | Raw byte pipe |
 | NullStream | -- | Yes | Discard sink (byte counter for benchmarks) |
 
-Streams implement `IOStream` (byte-level) and `pes::Stream` (frame-level). `input()` / `output()` resolve URL strings to PES stream instances. `open_input()` / `open_output()` resolve to byte-level IOStream instances. All URLs use the `scheme://path` format — bare paths are rejected.
+Streams implement `pes::Stream` (frame-level). `input()` / `output()` resolve URL strings to PES stream instances. All URLs use the `scheme://path` format — bare paths are rejected.
 
 AACS decryption requires a KEYDB.cfg file. If available at `~/.config/aacs/KEYDB.cfg` or passed via `ScanOptions`, the library handles everything — handshake, key derivation, and per-sector decryption — without the application needing to know anything about encryption.
 
 ## Architecture
 
 ```text
-Drive                  — open, identify, init, unlock, read (with recovery)
+Drive                  — open, identify, init, unlock, single-shot read
   ├── ScsiTransport    — SG_IO (Linux), IOKit (macOS), SPTI (Windows)
   ├── DriveProfile     — per-drive unlock parameters (bundled)
   └── PlatformDriver   — MediaTek (supported), Renesas (planned)
@@ -134,7 +159,7 @@ All errors are structured with numeric codes. No user-facing English text — ap
 
 ## Contributing
 
-Run `freemkv drive-info --share` with the [freemkv CLI](https://github.com/freemkv/freemkv) to contribute your drive's profile.
+Run `freemkv info disc:// --share` with the [freemkv CLI](https://github.com/freemkv/freemkv) to contribute your drive's profile.
 
 ## License
 

benches/sgio_read.rs

@@ -44,9 +44,15 @@ fn main() {
     let mut fail = 0u32;
     let mut bytes: u64 = 0;
 
+    // Recovery flag: true matches pre-0.11.13 bench behavior — full SCSI
+    // ECC retry loop on errors (slower, what the rip path used before the
+    // adaptive batch sizer landed). Flip to `false` for the fast-fail path
+    // that current rips use; benches are configurable via this constant.
+    const READ_WITH_RECOVERY: bool = true;
+
     for i in 0..1000u32 {
         let lba = i * batch as u32;
-        match drive.read(lba, batch, &mut buf) {
+        match drive.read(lba, batch, &mut buf, READ_WITH_RECOVERY) {
             Ok(_) => {
                 writer.write_all(&buf).unwrap();
                 ok += 1;

docs/README.md

@@ -12,6 +12,7 @@ Technical documentation for [libfreemkv](https://github.com/freemkv/libfreemkv),
 |----------|---------------|
 | [Architecture](architecture.md) | Module map, design principles, error codes, platform support |
 | [Drive Access](drive-access.md) | Drive, SCSI transport, profiles, unlock, why raw mode is needed |
+| [Rip Recovery](rip-recovery.md) | Three-layer recovery model: Disc::patch, single-shot Drive::read, DiscStream batch halving |
 | [AACS Encryption](aacs.md) | Key resolution (4 paths), content decryption, bus encryption, SCSI handshake |
 | [UDF Filesystem](udf.md) | UDF 2.50 with metadata partitions, pointer chain, how files are read from disc |
 | [MPLS Playlists](mpls.md) | Playlist format, play items, STN stream table, coding types |

docs/api-design.md

@@ -126,15 +126,45 @@ pub struct Event {
 }
 
 pub enum EventKind {
+    // Init / scan
+    DriveOpened { device: String },
+    DriveReady,
+    InitComplete { success: bool },
+    ProbeComplete { success: bool },
+    ScanComplete { titles: usize },
+
+    // Read pipeline
     BytesRead { bytes: u64, total: u64 },
     ReadError { sector: u64, error: Error },
-    Retry { attempt: u32 },
     SpeedChange { speed_kbs: u16 },
     ExtentStart { index: usize, start_sector: u64, sector_count: u64 },
+    SectorSkipped { sector: u64 },
+    BatchSizeChanged { new_size: u16, reason: BatchSizeReason },
     Complete { bytes: u64, errors: u32 },
+
+    // Kept for forward-compat; not emitted in 0.13.6+
+    Retry { attempt: u32 },
+    SectorRecovered { sector: u64 },
 }
 ```
 
+Emission notes:
+
+- `BytesRead { bytes, total }` is emitted from `DiscStream::fill_extents`
+  after each successful sector read. `bytes` is the cumulative running
+  total; `total` is the precomputed extent sum (0 if unknown).
+- `SpeedChange` is emitted from the public `Drive::set_speed` API path.
+  It is no longer emitted from a recovery hot loop (recovery loop removed
+  in 0.13.6).
+- `BatchSizeChanged` fires from the `DiscStream` adaptive sizer on shrink
+  (read failed at a larger size) and on probe-up (clean-read streak hit
+  the threshold). Consumers use it to display a "recovering" state
+  distinct from "ripping normally".
+- `Retry` and `SectorRecovered` are NOT emitted in 0.13.6+. They were
+  tied to the inline `Drive::read` recovery phases that were removed; the
+  variants are kept for forward compatibility so consumers' match arms
+  don't need conditional compilation.
+
 Events report what happened. App decides what to do. GUI shows a dialog. CLI
 prints a line. Server logs to file.
 
@@ -145,8 +175,8 @@ libfreemkv/src/
 ├── lib.rs              Public exports
 ├── error.rs            Error codes (no English)
 ├── event.rs            Event types for callbacks
-├── drive/              Drive (open, init, read with recovery)
-│   ├── mod.rs          Drive struct, init, read, reset, eject
+├── drive/              Drive (open, init, single-shot read)
+│   ├── mod.rs          Drive struct, init, read (single-shot), reset, eject
 │   ├── capture.rs      Drive profile capture for contribution
 │   ├── linux.rs        Linux drive discovery
 │   ├── macos.rs        macOS drive discovery

docs/architecture.md

@@ -41,8 +41,8 @@ AACS keys are derived internally, and all SCSI communication is handled in-proce
 libfreemkv (lib.rs)
 │
 ├── Drive Access
-│   ├── drive         Drive — open, identify, init, unlock, read (with recovery)
-│   ├── scsi          ScsiTransport trait + platform backends (SG_IO, IOKit, SPTI)
+│   ├── drive         Drive — open, identify, init, unlock, single-shot read
+│   ├── scsi          ScsiTransport trait + platform backends (sg async, IOKit, SPTI)
 │   ├── platform/     Platform trait — per-chipset command handlers
 │   │   └── mt1959    MediaTek MT1959 driver (LG, ASUS, HP)
 │   ├── profile       DriveProfile loading, matching, bundled JSON
@@ -83,7 +83,7 @@ libfreemkv (lib.rs)
 ```
 Drive::open(Path::new("/dev/sg4"))
   │
-  ├─ scsi::open()           Open /dev/sg4 via SG_IO
+  ├─ scsi::open()           Open /dev/sg4 (async write/poll/read)
   ├─ DriveId::from_drive()  INQUIRY + GET_CONFIG 010C
   ├─ profile::find_by_drive_id()  Match against bundled profiles
   ├─ Platform::new()        Instantiate chipset driver (Mt1959)
@@ -93,10 +93,17 @@ Drive::open(Path::new("/dev/sg4"))
 After open:
 - `init()` -- unlock + firmware upload + speed calibration
 - `probe_disc()` -- probe disc surface for optimal speeds
-- `read(lba, count, buf)` -- single read method with built-in error recovery
+- `read(lba, count, buf, recovery)` -- single-shot read; `recovery` only selects the per-CDB timeout (1.5 s vs. 30 s)
 - `wait_ready()` -- wait for disc insertion
 - `eject()` -- eject tray
 
+Recovery is layered above `Drive::read`, not inside it. Layer 1
+(`Disc::patch`) handles bad-range retry by replaying the ddrescue mapfile.
+Layer 3 (`DiscStream::fill_extents` adaptive batch sizer) handles in-loop
+request-size adaptation. Inline recovery (gentle retry → SCSI reset → retry)
+was removed in 0.13.6 — see [`rip-recovery.md`](rip-recovery.md) and
+`(internal)/postmortems/2026-04-25-stop-wedge-and-zero-kbs.md`.
+
 ---
 
 ## Disc Scanning Flow
@@ -175,7 +182,7 @@ is baked into the library.
 
 | Platform | Transport | Status |
 |----------|-----------|--------|
-| Linux | SG_IO ioctl on `/dev/sg*` | Supported |
+| Linux | async sg write/poll/read on `/dev/sg*` | Supported |
 | macOS | IOKit SCSITask | Supported |
 | Windows | SPTI (`IOCTL_SCSI_PASS_THROUGH_DIRECT`) | Supported |
 

docs/disc-to-rip.md

@@ -77,7 +77,9 @@ Insert disc
 10. Stream content (mux/disc.rs → DiscStream)
      │  Read sectors → decrypt → TS demux → PES frames
      │  Or: read sectors → decrypt → raw bytes (for ISO output)
-     │  Drive::read() handles error recovery (min speed → reset → retry)
+     │  Drive::read() is single-shot. DiscStream::fill_extents adapts the
+     │  batch size on failure (halve / probe-up). Bad-range retry is layer
+     │  1 above this — Disc::patch re-runs against the mapfile.
      │
      ▼
   PES frames → output stream (MKV, M2TS, network, etc.)
@@ -110,7 +112,7 @@ output.finish()?;
 
 | Module | Doc | Purpose |
 |--------|-----|---------|
-| drive/ | [drive-access.md](drive-access.md) | Open, identify, init, unlock, read (with recovery) |
+| drive/ | [drive-access.md](drive-access.md) | Open, identify, init, unlock, single-shot read |
 | scsi/ | [drive-access.md](drive-access.md) | Platform SCSI transport (Linux, macOS, Windows) |
 | udf.rs | [udf.md](udf.md) | UDF 2.50 filesystem |
 | mpls.rs | [mpls.md](mpls.md) | MPLS playlists + STN streams |

docs/drive-access.md

@@ -26,8 +26,8 @@ platform driver. The drive is ready for `wait_ready()` and `init()`.
 | `wait_ready()` | Wait for disc insertion (30s timeout, TUR polling) |
 | `init()` | Firmware upload + unlock + speed calibration |
 | `probe_disc()` | Probe disc surface for optimal speeds |
-| `read(lba, count, buf)` | Read sectors with built-in error recovery |
-| `reset()` | Close/reopen device, TUR, escalate if needed |
+| `read(lba, count, buf, recovery)` | Read sectors. Single-shot — no inline retries or reset. |
+| `reset()` | Eject-cycle escape hatch. Caller-invoked only; not on the read path. |
 | `lock_tray()` | Prevent tray ejection during rip |
 | `unlock_tray()` | Allow tray ejection (also runs on Drop) |
 | `eject()` | Eject disc tray |
@@ -44,16 +44,33 @@ platform driver. The drive is ready for `wait_ready()` and `init()`.
 3. Speed calibration after unlock
 4. Max 3 attempts before giving up
 
-### read() with Recovery
+### read() — single-shot
 
-`Drive::read()` is the single read method. On error:
+`Drive::read(lba, count, buf, recovery)` is the single read method. It issues
+exactly one READ(10) CDB and returns the result. The `recovery` parameter only
+selects the per-CDB timeout:
 
-1. Set minimum speed immediately
-2. Reset device (close/reopen/TUR)
-3. Wait 2s for drive to settle
-4. Retry at min speed, min batch (3 sectors)
-5. If still failing: skip sectors, zero-fill, log
-6. Stay at min speed for 500 MB after error (recovery window)
+| `recovery` | Timeout  | Used by                                  |
+|------------|----------|------------------------------------------|
+| `false`    | 1.5 s    | `Disc::copy` fast skip-forward sweep, `DiscStream::fill_extents` |
+| `true`     | 30 s     | `Disc::patch` multi-pass over the mapfile |
+
+On any SCSI failure or timeout, `read` returns `Err(DiscRead)` immediately.
+There are no inline retries, no SCSI reset, no Phase 1/2/3 escalation.
+
+Recovery is layered above `Drive::read`:
+
+- **Layer 1 — `Disc::patch`** loops over the ddrescue mapfile and re-issues
+  `read(.., recovery=true)` against each non-`+` range.
+- **Layer 3 — `DiscStream::fill_extents`** halves the request size on
+  failure, retries at the same LBA, and probes back up on a clean-read
+  streak.
+
+Inline recovery (5× gentle retry → close + reset + reopen → 5× more) was
+removed in 0.13.6. See `(internal)/postmortems/2026-04-25-stop-wedge-and-zero-kbs.md`
+for rationale: the inline reset wedged drive firmware on the LG BU40N (Initio
+USB-SATA bridge) without ever recovering a sector. See
+[`rip-recovery.md`](rip-recovery.md) for the full three-layer model.
 
 ---
 
@@ -70,8 +87,6 @@ pub trait ScsiTransport: Send {
         data: &mut [u8],
         timeout_ms: u32,
     ) -> Result<ScsiResult>;
-
-    fn reset(&mut self, device: &str) -> Result<()>;
 }
 ```
 
@@ -82,15 +97,29 @@ descriptors or calls ioctls outside of a `ScsiTransport` implementation.
 
 | Platform | Implementation | Device |
 |----------|---------------|--------|
-| Linux | `SgIoTransport` — `ioctl(fd, SG_IO, &hdr)` | `/dev/sg*` |
+| Linux | `SgIoTransport` — async `write`/`poll`/`read` on `/dev/sg*` | `/dev/sg*` |
 | macOS | `MacScsiTransport` — IOKit SCSITask | IOKit service |
 | Windows | `WindowsScsiTransport` — SPTI | `\\.\CdRomN` |
 
-The Linux backend opens with `O_RDWR | O_NONBLOCK`, constructs `sg_io_hdr`,
-and returns `ScsiResult` with status, bytes transferred, and sense data.
+The Linux backend uses the sg driver's asynchronous interface: `write()` submits
+the command, `poll()` waits with an enforceable wall-clock timeout, `read()`
+retrieves the result. If `poll()` times out, the fd is abandoned (closed in a
+background thread) and a fresh fd opened — the kernel's USB error recovery
+cannot block us. Opens with `O_RDWR | O_NONBLOCK`.
 
-On non-zero SCSI status, the transport parses sense key, ASC, and ASCQ from the
-sense buffer and returns `Error::ScsiError`.
+On non-zero SCSI status, the transport parses sense key from the sense buffer
+and returns `Error::ScsiError`.
+
+`SgIoTransport::reset` (Linux) does pure userspace state cleanup: an open +
+close pair to make the kernel cancel any SG_IO commands queued against a
+previous fd, a 2 s sleep to let the kernel finish that cancellation, then a
+fresh fd to send ALLOW MEDIUM REMOVAL to clear any stale tray lock. It does
+NOT issue `SG_SCSI_RESET` or escalate via STOP+START UNIT. Both were tried
+in 0.13.0–0.13.5 against the LG BU40N (Initio USB-SATA bridge); both failed
+to recover wedged drives and made the wedge worse. The macOS reset (which
+had been a no-op) was removed entirely in 0.13.6, and the top-level
+`scsi::reset()` / `reset_with_timeout()` / `reset_blocking()` wrappers were
+removed at the same time (no callers).
 
 ### CDB Builders
 

docs/rip-recovery.md

@@ -0,0 +1,181 @@
+# Rip recovery — three-layer architecture
+
+`libfreemkv` supports a multi-stage rip model for damaged or protection-bearing
+discs: a fast forward sweep that tolerates read failures, in-loop request-size
+adaptation that survives transient drive trouble without bailing, and targeted
+retry passes against a persistent bad-range map. The stream pipeline
+(`DiscStream` + `input`/`output`) operates against the resulting ISO image, so
+the mux stage never touches the drive.
+
+Recovery is layered cleanly. Each layer has one responsibility and does not
+reach into the others.
+
+| Layer | Where it lives | What it does |
+|-------|---------------|--------------|
+| 1 — Bad-range retry | `Disc::patch` (multi-pass over the mapfile) | Re-reads non-`+` ranges with the long timeout. Idempotent; call N times. |
+| 2 — Single-shot primitive | `Drive::read` in `src/drive/mod.rs` | One CDB, one timeout, one result. No inline retries, no SCSI reset. |
+| 3 — In-loop request adaptation | `DiscStream::fill_extents` adaptive batch sizer | Halves the batch on failure, retries at the same LBA, walks back up on a clean-read streak. |
+
+The caller orchestrates layer 1. Autorip's `rip_disc` loops `copy` then
+N × `patch` per the `MAX_RETRIES` config, then hands the ISO off to the
+existing mux pipeline. Layer 3 runs inside any consumer of `DiscStream`
+(direct PES pipeline, ISO playback, etc.) without caller involvement.
+
+Three primitives compose the disc-side flow:
+
+| Primitive                 | What it does                                                          |
+|---------------------------|-----------------------------------------------------------------------|
+| `Disc::copy`              | disc → ISO. Writes a sidecar `.mapfile`. Opt-in skip-forward on failure. |
+| `Disc::patch`             | Re-reads bad ranges from the drive. Idempotent; call N times.         |
+| `DiscStream` (ISO source) | Reads sectors from the ISO, feeds decrypt → demux → codec → mux.      |
+
+## Data model
+
+### Mapfile
+
+Format: [ddrescue](https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html)-compatible
+plain text, greppable, tool-interoperable. Flushed to disk on every `record()`
+so a crashed rip loses at most one block.
+
+```
+# Rescue Logfile. Created by libfreemkv v0.13.6
+# Current pos / status / pass / pass_time
+0x000000000  ?  1  0
+#      pos        size  status
+0x000000000  0x12a35d000    +
+0x12a35d000  0x000003000    -
+0x12a360000  0x009c4a000    +
+0x12d00a000  0x000064000    *
+```
+
+Status characters match ddrescue:
+
+| Char | Meaning                                            |
+|------|----------------------------------------------------|
+| `?`  | Not yet attempted                                  |
+| `*`  | Fast-pass failed; needs edge-trim                  |
+| `/`  | Trimmed; interior needs sector scrape              |
+| `-`  | Unreadable this session                            |
+| `+`  | Finished (good)                                    |
+
+Position and size are hex byte offsets into the ISO.
+
+### `CopyOptions` and `PatchOptions`
+
+Defaults preserve pre-`0.11.21` behavior — abort on the first unreadable
+sector. Opt in to the recovery-friendly path:
+
+```rust
+CopyOptions {
+    skip_on_error: true,   // zero-fill bad blocks, continue
+    skip_forward: true,    // exponential skip-forward after a failure
+    resume: true,          // pick up from an existing ISO + mapfile
+    decrypt: false,        // keep the ISO a raw disc image
+    ..Default::default()
+}
+```
+
+## Algorithm
+
+### Pass 1 — fast sweep (`Disc::copy`)
+
+1. Read 64 KB (32 sectors, one BD ECC block) at the current LBA via
+   `Drive::read(.., recovery=false)` — short 1.5 s timeout, single shot.
+2. On success: mark the range `+`, advance by one block.
+3. On failure (with `skip_on_error`): zero-fill the block in the ISO, mark
+   it `*`, advance.
+4. If `skip_forward` is set: after a failure, jump ahead by an exponentially
+   growing amount (256 KB initial, doubling on consecutive failures, capped at
+   1% of disc). The skipped bytes are also marked `*` — `patch` will visit
+   them later.
+5. Reset the skip size to 256 KB on the first success after a failure.
+
+Pass 1 completes when every byte has terminal status (`+`, `-`, or the caller
+bails via the halt flag).
+
+### Pass 2+ — patch (`Disc::patch`)
+
+`Disc::patch` reads the mapfile and iterates every non-`+` range. For each:
+
+1. Issue a drive read via `Drive::read(.., recovery=true)` — long 30 s
+   timeout, still single shot. Drive firmware does its own ECC and retries
+   inside that window; userspace does not pile on additional retries here.
+2. On success: write the good bytes into the ISO at the exact byte offset,
+   mark `+`.
+3. On failure: mark `-`.
+4. Update the mapfile after every block — crash-safe resume.
+
+Idempotent. Call `patch` N times for N retry attempts; typically the caller
+stops early if a pass recovers zero bytes (structure-protected sectors will
+never yield).
+
+### In-stream — adaptive batch halving (`DiscStream::fill_extents`)
+
+When a consumer reads a `DiscStream` directly (no ISO intermediate),
+`fill_extents` runs an adaptive sizer in front of `Drive::read`:
+
+1. Try the current preferred batch size (e.g. 32 sectors, one BD ECC block).
+2. On failure: halve the batch and retry at the same LBA. Emit
+   `EventKind::BatchSizeChanged { reason: Shrunk }`.
+3. On a clean-read streak: probe back up toward the preferred size. Emit
+   `EventKind::BatchSizeChanged { reason: Probed }`.
+4. If a single-sector read fails: skip (zero-fill, emit
+   `EventKind::SectorSkipped`) when `skip_errors` is set, otherwise return
+   `Err(DiscRead)`.
+
+This is layer 3. It exists so a transient single-sector glitch in a 32-sector
+batch can be isolated and read individually without the caller needing to
+implement retry logic.
+
+## Design choices
+
+**`Drive::read` is single-shot.** No inline retry phases, no SCSI reset,
+no eject cycle. The `recovery` flag controls only the per-CDB timeout
+(1.5 s vs. 30 s); on any failure it returns `Err(DiscRead)` immediately.
+Inline recovery (5× gentle retry → close + SCSI reset + reopen → 5× more)
+was removed in 0.13.6. See `(internal)/postmortems/2026-04-25-stop-wedge-and-zero-kbs.md`
+for rationale: the inline reset on the LG BU40N (Initio USB-SATA bridge)
+wedged drive firmware below the bridge without ever recovering a sector,
+and the gentle-retry phase produced long stretches of 0 KB/s with no
+recoveries to show for it. Recovery responsibility is now layered: layer 1
+handles ranges, layer 3 handles request size, neither touches the
+wedge-prone reset path.
+
+**No `MODE SELECT` to disable drive retries.** Research showed neither ddrescue
+nor MakeMKV does this. Drive firmware has access to raw analog signal, laser
+power control, and drive-specific ECC tuning that userspace can't replicate —
+disabling it throws away recovery headroom on marginal sectors. We fail fast
+via short SG_IO timeouts in pass 1 and let the firmware work the long timeout
+in pass 2 / patch.
+
+**No SCSI reset from any retry path.** `SgIoTransport::reset` (Linux) is
+trimmed to a kernel SG_IO state flush plus ALLOW MEDIUM REMOVAL — the
+`SG_SCSI_RESET` ioctl and STOP/START UNIT escalation were removed in 0.13.6.
+The macOS reset (which had been a no-op) was removed entirely. The top-level
+`scsi::reset()` / `reset_with_timeout()` / `reset_blocking()` wrappers were
+also removed (no callers). The remaining `Drive::reset()` is only invoked
+explicitly by callers that need an eject-cycle escape hatch — it is never
+reached from a read path.
+
+**ISO intermediate, even for single-pass.** Pass 1 always writes an ISO. The
+mux stage reads the ISO via `IsoSectorReader`. For single-pass (no retries),
+this adds ~2-3 min (local disk mux) but gains resumability across crashes,
+re-muxability without re-ripping, and a persistent forensic artifact. Callers
+who need pure speed can bypass and use `DiscStream::new(Box::new(drive), …)`
+directly — the lib doesn't forbid it, and layer 3 (adaptive batch halving)
+still applies there.
+
+**Mapfile in ddrescue format.** Plain text so users can `less` it, `diff` it,
+or feed it to ddrescue's own tooling. Crash-safe (flush-per-record). Entries
+coalesce on adjacent same-status ranges so files stay small.
+
+**Patches target `-`, `*`, `/`, and `?` alike.** The status state machine is
+ddrescue's but `patch` collapses the distinction — it just tries every
+non-finished range with the long timeout. Future work can specialize (trim vs.
+scrape vs. retry with direction reversal) if there's measured benefit.
+
+## References
+
+- [ddrescue manual, Algorithm chapter](https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html)
+- [ddrescue optical media notes](https://www.electric-spoon.com/doc/gddrescue/html/Optical-media.html)
+- Source: [`src/disc/mapfile.rs`](../src/disc/mapfile.rs), [`src/disc/mod.rs`](../src/disc/mod.rs) (`Disc::copy`, `Disc::patch`), [`src/drive/mod.rs`](../src/drive/mod.rs) (`Drive::read`), [`src/mux/disc.rs`](../src/mux/disc.rs) (`DiscStream::fill_extents`).

docs/udf.md

@@ -120,6 +120,14 @@ Each directory read involves two sector reads: one for the ICB, then one or more
 
 `read_file()` reads a file by navigating the directory tree, reading the file's ICB to get its data extent, then reading the data sector by sector from the **physical partition** (partition_start + LBA, not metadata_start).
 
+## Buffered Sector Reads
+
+USB optical drives have ~500ms round-trip latency per SCSI command. Since `read_filesystem()` and `read_file()` issue one SCSI READ per sector, a full disc scan can require hundreds of commands -- taking 10+ minutes on USB.
+
+`Disc::scan()` wraps the drive in a `BufferedSectorReader` before reading. On a single-sector read, the buffer prefetches a batch of sectors (sized from the kernel's `max_hw_sectors_kb` for the device) and caches them. Subsequent reads to nearby LBAs return from cache with zero SCSI overhead. After parsing the UDF directory structure, the entire metadata partition is pre-read into the cache, so all ICB lookups during title scanning and encryption resolution are instant.
+
+The buffer is transparent -- `read_filesystem()`, `read_file()`, and all downstream code still call `read_sectors(lba, 1, buf)` as before. The batching happens inside the `SectorReader` implementation.
+
 ### UDF Filename Encoding
 
 UDF filenames use a compression ID as the first byte:

examples/iso_dump.rs

@@ -42,7 +42,7 @@ fn main() {
         // Tiny yield between reads — test if pacing prevents firmware throttle
         std::thread::yield_now();
         let t0 = Instant::now();
-        let ok = drive.read(lba, count, &mut buf[..n]).is_ok();
+        let ok = drive.read(lba, count, &mut buf[..n], true).is_ok();
         let read_ms = t0.elapsed().as_millis();
 
         // Flag slow reads

rustfmt.toml

@@ -0,0 +1 @@
+max_width = 100

src/aacs/decrypt.rs

@@ -1,7 +1,7 @@
 //! AACS content decryption — AES primitives, unit decryption, bus encryption.
 
-use aes::cipher::{generic_array::GenericArray, BlockDecrypt, BlockEncrypt, KeyInit};
 use aes::Aes128;
+use aes::cipher::{BlockDecrypt, BlockEncrypt, KeyInit, generic_array::GenericArray};
 
 // ── AACS constants ──────────────────────────────────────────────────────────
 

src/aacs/handshake.rs

@@ -674,8 +674,8 @@ fn generate_host_key_pair() -> ([u8; 20], [u8; 20], [u8; 20]) {
 
 /// AES-128-CMAC over 16 bytes of data.
 fn aes_cmac_16(data: &[u8; 16], key: &[u8; 16]) -> [u8; 16] {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
     use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
 
     let cipher = Aes128::new(GenericArray::from_slice(key));
 

src/aacs/keydb.rs

@@ -361,11 +361,7 @@ mod tests {
     /// Get KEYDB path from KEYDB_PATH environment variable. Returns None if not set or not found.
     fn keydb_path() -> Option<std::path::PathBuf> {
         let path = std::path::PathBuf::from(std::env::var("KEYDB_PATH").ok()?);
-        if path.exists() {
-            Some(path)
-        } else {
-            None
-        }
+        if path.exists() { Some(path) } else { None }
     }
 
     #[test]

src/aacs/keys.rs

@@ -661,18 +661,14 @@ pub fn resolve_keys(
 
 #[cfg(test)]
 mod tests {
-    use super::super::decrypt::{aes_ecb_encrypt, ALIGNED_UNIT_LEN};
+    use super::super::decrypt::{ALIGNED_UNIT_LEN, aes_ecb_encrypt};
     use super::super::keydb::{DiscEntry, KeyDb};
     use super::*;
 
     /// Get KEYDB path from KEYDB_PATH environment variable. Returns None if not set or not found.
     fn keydb_path() -> Option<std::path::PathBuf> {
         let path = std::path::PathBuf::from(std::env::var("KEYDB_PATH").ok()?);
-        if path.exists() {
-            Some(path)
-        } else {
-            None
-        }
+        if path.exists() { Some(path) } else { None }
     }
 
     #[test]
@@ -849,7 +845,7 @@ mod tests {
         data[23] = 1; // top_menu = CPS unit 1
         data[24] = 0;
         data[25] = 1; // num_titles = 1
-                      // Title 0 entry: 2 bytes pad + CPS unit
+        // Title 0 entry: 2 bytes pad + CPS unit
         data[28] = 0;
         data[29] = 1; // CPS unit 1
 

src/aacs/mod.rs

@@ -21,12 +21,12 @@ pub mod keys;
 // Explicit re-exports — only items needed by external consumers and sibling crate modules.
 // AES primitives (aes_ecb_encrypt, aes_ecb_decrypt, aes_cbc_decrypt) are pub(crate) in decrypt.rs.
 pub use decrypt::{
-    decrypt_bus, decrypt_unit, decrypt_unit_full, decrypt_unit_try_keys, is_unit_encrypted,
-    ALIGNED_UNIT_LEN,
+    ALIGNED_UNIT_LEN, decrypt_bus, decrypt_unit, decrypt_unit_full, decrypt_unit_try_keys,
+    is_unit_encrypted,
 };
 pub use keydb::{DeviceKey, DiscEntry, HostCert, KeyDb};
 pub use keys::{
-    decrypt_unit_key, derive_media_key_from_dk, derive_media_key_from_pk, derive_vuk, disc_hash,
-    disc_hash_hex, mkb_version, parse_content_cert, parse_unit_key_ro, read_mkb_from_drive,
-    resolve_keys, ContentCert, ResolvedKeys, UnitKeyFile,
+    ContentCert, ResolvedKeys, UnitKeyFile, decrypt_unit_key, derive_media_key_from_dk,
+    derive_media_key_from_pk, derive_vuk, disc_hash, disc_hash_hex, mkb_version,
+    parse_content_cert, parse_unit_key_ro, read_mkb_from_drive, resolve_keys,
 };

src/css/auth.rs

@@ -326,13 +326,11 @@ fn read_disc_key(drive: &mut Drive, agid: u8, bus_key: &[u8; 5]) -> Result<[u8;
     // Disc key block starts at offset 4 (skip 4-byte header)
     let disc_key_block = &mut buf[4..4 + 2048];
 
-
     // XOR with reversed bus key (per libdvdcss)
     for (i, byte) in disc_key_block.iter_mut().enumerate() {
         *byte ^= bus_key[4 - (i % 5)];
     }
 
-
     // Try each player key against each of 408 disc key entries.
     // Each entry in the block is the disc key encrypted with a specific player key.
     // We try all known player keys and verify by checking that two different
@@ -350,7 +348,7 @@ fn read_disc_key(drive: &mut Drive, agid: u8, bus_key: &[u8; 5]) -> Result<[u8;
             let candidate = super::lfsr::decrypt_key(0x00, player_key, &enc);
 
             // Check if any previous candidate matches (same disc key from different entry/pk)
-            for &(ref prev, _, _) in &candidates {
+            for (prev, _, _) in &candidates {
                 if *prev == candidate {
                     return Ok(candidate);
                 }
@@ -393,6 +391,7 @@ fn read_raw_title_key(drive: &mut Drive, agid: u8, lba: u32) -> Result<[u8; 5]>
     Ok(key)
 }
 
+#[allow(dead_code)]
 fn read_title_key(
     drive: &mut Drive,
     agid: u8,
@@ -421,7 +420,6 @@ fn read_title_key(
     );
     tk_result.map_err(|_| Error::CssAuthFailed)?;
 
-
     // Title key at bytes 5..10, byte-reversed
     let mut title_key = [0u8; 5];
     for i in 0..5 {

src/css/crack.rs

@@ -204,7 +204,9 @@ pub fn crack_title_key(sector: &[u8]) -> Option<[u8; 5]> {
     // Padding stream (0xBE): payload is 0xFF bytes, various lengths
     for len_hi in 0u8..8 {
         for len_lo_top in [0x00u8, 0x80, 0xFF] {
-            patterns.push([0x00, 0x00, 0x01, 0xBE, len_hi, len_lo_top, 0xFF, 0xFF, 0xFF, 0xFF]);
+            patterns.push([
+                0x00, 0x00, 0x01, 0xBE, len_hi, len_lo_top, 0xFF, 0xFF, 0xFF, 0xFF,
+            ]);
         }
     }
 
@@ -216,7 +218,9 @@ pub fn crack_title_key(sector: &[u8]) -> Option<[u8; 5]> {
                 let pts0 = if flags2 & 0x80 != 0 { 0x21u8 } else { 0x00 };
                 // Try with several PES lengths
                 for &len_hi in &[0x00u8, 0x07] {
-                    patterns.push([0x00, 0x00, 0x01, sid, len_hi, 0x00, flags1, flags2, hdr_len, pts0]);
+                    patterns.push([
+                        0x00, 0x00, 0x01, sid, len_hi, 0x00, flags1, flags2, hdr_len, pts0,
+                    ]);
                 }
             }
         }

src/css/lfsr.rs

@@ -149,7 +149,7 @@ mod tests {
         let key = [0x01, 0x02, 0x03, 0x04, 0x05];
         let mut sector = vec![0xAA; 2048];
         sector[0x14] = 0x30; // scramble flag set
-                             // Set a sector seed
+        // Set a sector seed
         sector[0x54..0x59].copy_from_slice(&[0x11, 0x22, 0x33, 0x44, 0x55]);
         let original = sector.clone();
         descramble_sector(&key, &mut sector);

src/css/mod.rs

@@ -42,7 +42,11 @@ pub fn crack_key(reader: &mut dyn SectorReader, extents: &[Extent]) -> Option<Cs
         let mut i = 0;
         while i < ext.sector_count && tried < max_tries {
             let mut buf = vec![0u8; 2048];
-            if reader.read_sectors(ext.start_lba + i, 1, &mut buf).is_ok() && is_scrambled(&buf) {
+            if reader
+                .read_sectors(ext.start_lba + i, 1, &mut buf, true)
+                .is_ok()
+                && is_scrambled(&buf)
+            {
                 if let Some(key) = crack::crack_title_key(&buf) {
                     return Some(CssState { title_key: key });
                 }

src/disc/bluray.rs

@@ -66,17 +66,18 @@ impl Disc {
                     pkt_count = clip_info.source_packet_count;
                     total_size += pkt_count as u64 * 192;
 
-                    // Get m2ts file start LBA and compute extent from packet count.
-                    // BD-ROM m2ts files are contiguous on disc (mastering requirement).
+                    // Get m2ts file extents from UDF allocation descriptors.
+                    // Dual-layer discs split files across layers — UDF knows the real layout.
                     let m2ts_path = format!("/BDMV/STREAM/{}.m2ts", play_item.clip_id);
-                    let file_lba = udf_fs.file_start_lba(reader, &m2ts_path).unwrap_or(0);
-                    let total_bytes = pkt_count as u64 * 192;
-                    let total_sectors = total_bytes.div_ceil(2048) as u32;
-                    if total_sectors > 0 && file_lba > 0 {
-                        extents.push(Extent {
-                            start_lba: file_lba,
-                            sector_count: total_sectors,
-                        });
+                    if let Ok(file_exts) = udf_fs.file_extents(reader, &m2ts_path) {
+                        for (lba, sectors) in file_exts {
+                            if sectors > 0 && lba > 0 {
+                                extents.push(Extent {
+                                    start_lba: lba,
+                                    sector_count: sectors,
+                                });
+                            }
+                        }
                     }
                 }
             }
@@ -131,6 +132,7 @@ impl Disc {
                                 codec,
                                 language: s.language.clone(),
                                 forced: false,
+                                qualifier: crate::disc::LabelQualifier::None,
                                 codec_data: None,
                             }))
                         } else {
@@ -141,6 +143,7 @@ impl Disc {
                                 language: s.language.clone(),
                                 sample_rate: SampleRate::from_audio_rate(s.audio_rate),
                                 secondary: s.stream_type == 5,
+                                purpose: crate::disc::LabelPurpose::Normal,
                                 label: String::new(),
                             }))
                         }
@@ -150,6 +153,7 @@ impl Disc {
                         codec,
                         language: s.language.clone(),
                         forced: false,
+                        qualifier: crate::disc::LabelQualifier::None,
                         codec_data: None,
                     })),
                     // Stream type 4 = IG, unknown types -- skip
@@ -158,12 +162,12 @@ impl Disc {
             })
             .collect();
 
-        // Convert marks to chapters (filter mark_type == 1 = chapter entry)
+        // Convert marks to chapters (mark_type 0 or 1 = chapter entry, 2 = link)
         let first_in_time = parsed.play_items.first().map(|pi| pi.in_time).unwrap_or(0);
         let chapters: Vec<Chapter> = parsed
             .marks
             .iter()
-            .filter(|m| m.mark_type == 1)
+            .filter(|m| m.mark_type <= 1)
             .enumerate()
             .map(|(i, m)| {
                 let time_secs = (m.timestamp as f64 - first_in_time as f64) / 45000.0;

src/disc/dvd.rs

@@ -48,6 +48,7 @@ impl Disc {
                         language: a.language.clone(),
                         sample_rate: SampleRate::from_hz(a.sample_rate),
                         secondary: false,
+                        purpose: crate::disc::LabelPurpose::Normal,
                         label: String::new(),
                     })
                 })
@@ -92,6 +93,7 @@ impl Disc {
                             codec: Codec::DvdSub,
                             language: s.language.clone(),
                             forced: false,
+                            qualifier: crate::disc::LabelQualifier::None,
                             codec_data: codec_data.clone(),
                         })
                     })
@@ -101,6 +103,16 @@ impl Disc {
                 streams.extend(audio_streams.iter().cloned());
                 streams.extend(subtitle_streams);
 
+                let chapters: Vec<Chapter> = dvd_title
+                    .chapter_times
+                    .iter()
+                    .enumerate()
+                    .map(|(i, &t)| Chapter {
+                        time_secs: t,
+                        name: format!("Chapter {}", i + 1),
+                    })
+                    .collect();
+
                 titles.push(DiscTitle {
                     playlist: format!("VTS_{:02}_{}.VOB", ts.vts_number, title_number),
                     playlist_id: title_number,
@@ -108,7 +120,7 @@ impl Disc {
                     size_bytes,
                     clips: Vec::new(),
                     streams,
-                    chapters: Vec::new(),
+                    chapters,
                     extents,
                     content_format: ContentFormat::MpegPs,
                     codec_privates: Vec::new(),

src/disc/mapfile.rs

@@ -0,0 +1,453 @@
+//! ddrescue-compatible mapfile for tracking rip progress.
+//!
+//! Records which byte ranges of a disc image are good, unreadable,
+//! or not-yet-attempted. Written as plain text so it's greppable,
+//! human-editable, and interoperates with ddrescue's own tools.
+//!
+//! Format:
+//! ```text
+//! # Rescue Logfile. Created by libfreemkv v0.11.21
+//! # Current pos / status / pass / pass_time (ddrescue state machine — we only populate pos)
+//! 0x000000000  ?  1  0
+//! #      pos        size  status
+//! 0x000000000  0x12345678    +
+//! 0x012345678  0x00001000    -
+//! 0x012346678  0x01234500    ?
+//! ```
+//!
+//! Status chars: `?` non-tried · `*` non-trimmed · `/` non-scraped · `-` unreadable · `+` finished.
+//!
+//! The mapfile is flushed to disk on every `record()` call so a crashed
+//! rip loses at most one block of recorded state.
+
+use std::io::{self, Write};
+use std::path::{Path, PathBuf};
+
+/// Status of a byte range in the mapfile. ddrescue-compatible.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SectorStatus {
+    /// `?` — not yet attempted. Initial state for a fresh mapfile.
+    NonTried,
+    /// `*` — fast-pass read failed; edges need trimming.
+    NonTrimmed,
+    /// `/` — trimmed; interior needs sector scrape.
+    NonScraped,
+    /// `-` — drive couldn't read it this session.
+    Unreadable,
+    /// `+` — good.
+    Finished,
+}
+
+impl SectorStatus {
+    pub fn to_char(self) -> char {
+        match self {
+            Self::NonTried => '?',
+            Self::NonTrimmed => '*',
+            Self::NonScraped => '/',
+            Self::Unreadable => '-',
+            Self::Finished => '+',
+        }
+    }
+    pub fn from_char(c: char) -> Option<Self> {
+        Some(match c {
+            '?' => Self::NonTried,
+            '*' => Self::NonTrimmed,
+            '/' => Self::NonScraped,
+            '-' => Self::Unreadable,
+            '+' => Self::Finished,
+            _ => return None,
+        })
+    }
+}
+
+/// One contiguous range of bytes with a status.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MapEntry {
+    pub pos: u64,
+    pub size: u64,
+    pub status: SectorStatus,
+}
+
+/// Summary statistics over all entries.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct MapStats {
+    pub bytes_total: u64,
+    pub bytes_good: u64,
+    pub bytes_unreadable: u64,
+    pub bytes_pending: u64,
+}
+
+/// Write-through mapfile. Every `record()` persists to disk immediately
+/// so a crash during rip loses at most one block.
+pub struct Mapfile {
+    path: PathBuf,
+    entries: Vec<MapEntry>,
+    total_size: u64,
+    version: String,
+}
+
+impl Mapfile {
+    /// Create a new mapfile with one `NonTried` region covering the whole disc.
+    /// Writes to disk immediately so a resume can pick up even if the caller
+    /// never records anything.
+    pub fn create(path: &Path, total_size: u64, version: &str) -> io::Result<Self> {
+        let mf = Self {
+            path: path.to_path_buf(),
+            entries: vec![MapEntry {
+                pos: 0,
+                size: total_size,
+                status: SectorStatus::NonTried,
+            }],
+            total_size,
+            version: version.to_string(),
+        };
+        mf.write_to_disk()?;
+        Ok(mf)
+    }
+
+    /// Load an existing mapfile from disk.
+    pub fn load(path: &Path) -> io::Result<Self> {
+        let text = std::fs::read_to_string(path)?;
+        let mut entries = Vec::new();
+        let mut saw_current_line = false;
+        let mut version = String::from("unknown");
+        for line in text.lines() {
+            let t = line.trim();
+            if t.is_empty() {
+                continue;
+            }
+            if let Some(rest) = t.strip_prefix('#') {
+                let rest = rest.trim();
+                if let Some(v) = rest.strip_prefix("Rescue Logfile. Created by ") {
+                    version = v.to_string();
+                }
+                continue;
+            }
+            // First non-comment line is the "current" state line (pos status [pass] [pass_time]).
+            // We ignore its contents but skip over it.
+            if !saw_current_line {
+                saw_current_line = true;
+                // But if the line looks like an entry (has at least 3 fields starting 0x...),
+                // it's probably actually an entry for a mapfile we wrote without a current line.
+                // Heuristic: current line has status char as 2nd field; entry has size as 2nd field.
+                let fields: Vec<&str> = t.split_whitespace().collect();
+                if fields.len() >= 3 && fields[1].starts_with("0x") {
+                    // It's an entry, not a current line — fall through to entry parse.
+                } else {
+                    continue;
+                }
+            }
+            // Entry: `pos size statuschar`
+            let fields: Vec<&str> = t.split_whitespace().collect();
+            if fields.len() < 3 {
+                continue;
+            }
+            let pos = parse_hex(fields[0])?;
+            let size = parse_hex(fields[1])?;
+            let status = fields[2]
+                .chars()
+                .next()
+                .and_then(SectorStatus::from_char)
+                .ok_or_else(|| {
+                    // No English text — the variant carries a stable
+                    // language-neutral kind identifier (`status_char`).
+                    let e: io::Error = crate::error::Error::MapfileInvalid {
+                        kind: "status_char",
+                    }
+                    .into();
+                    e
+                })?;
+            entries.push(MapEntry { pos, size, status });
+        }
+        entries.sort_by_key(|e| e.pos);
+        let total_size = entries.last().map(|e| e.pos + e.size).unwrap_or(0);
+        Ok(Self {
+            path: path.to_path_buf(),
+            entries,
+            total_size,
+            version,
+        })
+    }
+
+    /// Load if the file exists, otherwise create a fresh mapfile.
+    pub fn open_or_create(path: &Path, total_size: u64, version: &str) -> io::Result<Self> {
+        match Self::load(path) {
+            Ok(mf) => Ok(mf),
+            Err(e) if e.kind() == io::ErrorKind::NotFound => {
+                Self::create(path, total_size, version)
+            }
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Mark a byte range as having the given status. Splits any overlapping
+    /// existing entries, merges with adjacent same-status entries, and flushes
+    /// to disk.
+    pub fn record(&mut self, pos: u64, size: u64, status: SectorStatus) -> io::Result<()> {
+        if size == 0 {
+            return Ok(());
+        }
+        let end = pos.saturating_add(size);
+        let mut new_entries = Vec::with_capacity(self.entries.len() + 2);
+
+        for e in self.entries.drain(..) {
+            let e_end = e.pos + e.size;
+            if e_end <= pos || e.pos >= end {
+                // entirely before or after — keep
+                new_entries.push(e);
+                continue;
+            }
+            // Overlap — keep portions outside [pos, end)
+            if e.pos < pos {
+                new_entries.push(MapEntry {
+                    pos: e.pos,
+                    size: pos - e.pos,
+                    status: e.status,
+                });
+            }
+            if e_end > end {
+                new_entries.push(MapEntry {
+                    pos: end,
+                    size: e_end - end,
+                    status: e.status,
+                });
+            }
+        }
+        new_entries.push(MapEntry { pos, size, status });
+        new_entries.sort_by_key(|e| e.pos);
+
+        // Coalesce adjacent same-status entries.
+        let mut merged: Vec<MapEntry> = Vec::with_capacity(new_entries.len());
+        for e in new_entries {
+            if let Some(last) = merged.last_mut() {
+                if last.pos + last.size == e.pos && last.status == e.status {
+                    last.size += e.size;
+                    continue;
+                }
+            }
+            merged.push(e);
+        }
+
+        self.entries = merged;
+        self.write_to_disk()?;
+        Ok(())
+    }
+
+    pub fn entries(&self) -> &[MapEntry] {
+        &self.entries
+    }
+
+    pub fn total_size(&self) -> u64 {
+        self.total_size
+    }
+
+    /// First range with a given status starting at or after `from`.
+    pub fn next_with(&self, from: u64, status: SectorStatus) -> Option<(u64, u64)> {
+        for e in &self.entries {
+            if e.status != status {
+                continue;
+            }
+            let e_end = e.pos + e.size;
+            if e_end <= from {
+                continue;
+            }
+            let start = e.pos.max(from);
+            return Some((start, e_end - start));
+        }
+        None
+    }
+
+    /// All ranges matching one of the given statuses, in position order.
+    pub fn ranges_with(&self, statuses: &[SectorStatus]) -> Vec<(u64, u64)> {
+        self.entries
+            .iter()
+            .filter(|e| statuses.contains(&e.status))
+            .map(|e| (e.pos, e.size))
+            .collect()
+    }
+
+    pub fn stats(&self) -> MapStats {
+        let mut s = MapStats {
+            bytes_total: self.total_size,
+            ..Default::default()
+        };
+        for e in &self.entries {
+            match e.status {
+                SectorStatus::Finished => s.bytes_good += e.size,
+                SectorStatus::Unreadable => s.bytes_unreadable += e.size,
+                SectorStatus::NonTried | SectorStatus::NonTrimmed | SectorStatus::NonScraped => {
+                    s.bytes_pending += e.size
+                }
+            }
+        }
+        s
+    }
+
+    fn write_to_disk(&self) -> io::Result<()> {
+        // Write to a tempfile then rename for atomicity. Appending ".tmp"
+        // rather than `with_extension` so we don't clobber the original
+        // extension (which may already be ".mapfile").
+        let tmp = {
+            let mut s = self.path.clone().into_os_string();
+            s.push(".tmp");
+            PathBuf::from(s)
+        };
+        {
+            let file = std::fs::File::create(&tmp)?;
+            let mut w = std::io::BufWriter::new(file);
+            writeln!(
+                w,
+                "# Rescue Logfile. Created by libfreemkv v{}",
+                self.version
+            )?;
+            writeln!(w, "# Current pos / status / pass / pass_time")?;
+            writeln!(w, "0x000000000  ?  1  0")?;
+            writeln!(w, "#      pos        size  status")?;
+            for e in &self.entries {
+                writeln!(
+                    w,
+                    "0x{:09x}  0x{:09x}    {}",
+                    e.pos,
+                    e.size,
+                    e.status.to_char()
+                )?;
+            }
+            w.flush()?;
+        }
+        std::fs::rename(&tmp, &self.path)?;
+        Ok(())
+    }
+}
+
+fn parse_hex(s: &str) -> io::Result<u64> {
+    let s = s.strip_prefix("0x").unwrap_or(s);
+    u64::from_str_radix(s, 16).map_err(|_| {
+        // Underlying ParseIntError dropped — its Display is OS-locale text.
+        // The typed variant carries `kind = "hex"` which is stable.
+        let e: io::Error = crate::error::Error::MapfileInvalid { kind: "hex" }.into();
+        e
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tmpfile(tag: &str) -> PathBuf {
+        use std::sync::atomic::{AtomicU64, Ordering};
+        static CTR: AtomicU64 = AtomicU64::new(0);
+        let n = CTR.fetch_add(1, Ordering::Relaxed);
+        let name = format!(
+            "libfreemkv-mapfile-test-{}-{}-{}.mapfile",
+            std::process::id(),
+            tag,
+            n
+        );
+        std::env::temp_dir().join(name)
+    }
+
+    #[test]
+    fn create_has_one_nontried_region() {
+        let p = tmpfile("create_has_one_nontried_region");
+        let _ = std::fs::remove_file(&p);
+        let mf = Mapfile::create(&p, 1000, "test").unwrap();
+        assert_eq!(mf.entries().len(), 1);
+        assert_eq!(mf.entries()[0].pos, 0);
+        assert_eq!(mf.entries()[0].size, 1000);
+        assert_eq!(mf.entries()[0].status, SectorStatus::NonTried);
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn record_splits_overlap() {
+        let p = tmpfile("record_splits_overlap");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(200, 100, SectorStatus::Finished).unwrap();
+        let es = mf.entries();
+        assert_eq!(es.len(), 3);
+        assert_eq!(
+            (es[0].pos, es[0].size, es[0].status),
+            (0, 200, SectorStatus::NonTried)
+        );
+        assert_eq!(
+            (es[1].pos, es[1].size, es[1].status),
+            (200, 100, SectorStatus::Finished)
+        );
+        assert_eq!(
+            (es[2].pos, es[2].size, es[2].status),
+            (300, 700, SectorStatus::NonTried)
+        );
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn record_coalesces_adjacent_same_status() {
+        let p = tmpfile("record_coalesces_adjacent_same_status");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(100, 100, SectorStatus::Finished).unwrap();
+        mf.record(200, 100, SectorStatus::Finished).unwrap();
+        // Entries: [0..100 NonTried, 100..300 Finished (merged), 300..1000 NonTried]
+        let es = mf.entries();
+        assert_eq!(es.len(), 3);
+        assert_eq!(
+            (es[1].pos, es[1].size, es[1].status),
+            (100, 200, SectorStatus::Finished)
+        );
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn record_replaces_existing_status() {
+        let p = tmpfile("record_replaces_existing_status");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(200, 100, SectorStatus::Unreadable).unwrap();
+        mf.record(200, 100, SectorStatus::Finished).unwrap();
+        let es = mf.entries();
+        // The overwrite should result in all finished at 200..300, NonTried elsewhere — 3 entries.
+        assert_eq!(es.len(), 3);
+        assert_eq!(es[1].status, SectorStatus::Finished);
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn round_trip_load() {
+        let p = tmpfile("round_trip_load");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(100, 200, SectorStatus::Finished).unwrap();
+        mf.record(500, 100, SectorStatus::Unreadable).unwrap();
+        let loaded = Mapfile::load(&p).unwrap();
+        assert_eq!(loaded.entries(), mf.entries());
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn stats_sum_correctly() {
+        let p = tmpfile("stats_sum_correctly");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(0, 400, SectorStatus::Finished).unwrap();
+        mf.record(400, 100, SectorStatus::Unreadable).unwrap();
+        let s = mf.stats();
+        assert_eq!(s.bytes_good, 400);
+        assert_eq!(s.bytes_unreadable, 100);
+        assert_eq!(s.bytes_pending, 500);
+        assert_eq!(s.bytes_total, 1000);
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn ranges_with_filters() {
+        let p = tmpfile("ranges_with_filters");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(100, 50, SectorStatus::Unreadable).unwrap();
+        mf.record(300, 50, SectorStatus::Unreadable).unwrap();
+        let bad = mf.ranges_with(&[SectorStatus::Unreadable]);
+        assert_eq!(bad, vec![(100, 50), (300, 50)]);
+        let _ = std::fs::remove_file(&p);
+    }
+}

src/disc/mod.rs

@@ -11,6 +11,7 @@
 mod bluray;
 mod dvd;
 mod encrypt;
+pub mod mapfile;
 
 use crate::drive::Drive;
 use crate::error::{Error, Result};
@@ -19,6 +20,11 @@ use crate::udf;
 
 use encrypt::HandshakeResult;
 
+// Re-export label classification enums alongside AudioStream / SubtitleStream
+// so the public surface keeps the structured metadata together. Callers map
+// these to display text in their own locale.
+pub use crate::labels::{LabelPurpose, LabelQualifier};
+
 // ─── Public types ───────────────────────────────────────────────────────────
 
 /// A scanned Blu-ray disc.
@@ -179,7 +185,11 @@ pub struct AudioStream {
     pub sample_rate: SampleRate,
     /// Whether this is a secondary stream (commentary)
     pub secondary: bool,
-    /// Extra label
+    /// Stream purpose (commentary / descriptive / score / IME / normal).
+    /// Callers translate this to display text in their own locale.
+    pub purpose: LabelPurpose,
+    /// Codec / variant text (e.g. "Dolby TrueHD 5.1", "(US)").
+    /// NEVER contains English purpose words — see `purpose` for that.
     pub label: String,
 }
 
@@ -194,6 +204,9 @@ pub struct SubtitleStream {
     pub language: String,
     /// Whether this is a forced subtitle
     pub forced: bool,
+    /// Subtitle qualifier (SDH / descriptive service / forced / none).
+    /// Callers translate this to display text in their own locale.
+    pub qualifier: LabelQualifier,
     /// Pre-formatted codec private data (e.g. VobSub .idx palette header)
     pub codec_data: Option<Vec<u8>>,
 }
@@ -874,7 +887,8 @@ impl KeySource {
 
 /// Standard KEYDB.cfg search locations (compatible with libaacs).
 const KEYDB_SEARCH_PATHS: &[&str] = &[
-    ".config/aacs/KEYDB.cfg", // relative to $HOME
+    ".config/aacs/KEYDB.cfg",    // libaacs standard path
+    ".config/freemkv/keydb.cfg", // freemkv download path
 ];
 const KEYDB_SYSTEM_PATH: &str = "/etc/aacs/KEYDB.cfg";
 
@@ -887,13 +901,6 @@ pub struct ScanOptions {
 }
 
 impl ScanOptions {
-    /// Create options with a specific KEYDB path.
-    pub fn with_keydb(path: impl Into<std::path::PathBuf>) -> Self {
-        ScanOptions {
-            keydb_path: Some(path.into()),
-        }
-    }
-
     /// Resolve KEYDB path: explicit path first, then standard locations.
     fn resolve_keydb(&self) -> Option<std::path::PathBuf> {
         if let Some(p) = &self.keydb_path {
@@ -917,12 +924,75 @@ impl ScanOptions {
     }
 }
 
+/// Quick disc identification — name, format, capacity. No title/stream parsing.
+#[derive(Debug)]
+pub struct DiscId {
+    /// UDF Volume Identifier (always present, e.g. "V_FOR_VENDETTA")
+    pub volume_id: String,
+    /// Disc title from META/DL/bdmt_eng.xml (e.g. "V for Vendetta")
+    pub meta_title: Option<String>,
+    /// Disc format (BD, UHD, DVD) — UHD vs BD requires full scan to confirm
+    pub format: DiscFormat,
+    /// Disc capacity in sectors
+    pub capacity_sectors: u32,
+    /// Whether AACS directory exists (disc is likely encrypted)
+    pub encrypted: bool,
+    /// Number of layers
+    pub layers: u8,
+}
+
+impl DiscId {
+    /// Best available name: meta_title, then formatted volume_id.
+    pub fn name(&self) -> &str {
+        self.meta_title.as_deref().unwrap_or(&self.volume_id)
+    }
+}
+
 impl Disc {
+    /// Fast disc identification — reads only UDF metadata for name and format.
+    /// No AACS handshake, no playlist parsing, no CLPI, no labels.
+    /// Typically completes in 2-3 seconds on USB drives.
+    pub fn identify(session: &mut Drive) -> Result<DiscId> {
+        let (capacity, mut buffered, udf_fs) = Self::read_udf(session)?;
+
+        let meta_title = Self::read_meta_title(&mut buffered, &udf_fs);
+        let format = if udf_fs.find_dir("/BDMV").is_some() {
+            DiscFormat::BluRay // full scan distinguishes UHD vs BD
+        } else if udf_fs.find_dir("/VIDEO_TS").is_some() {
+            DiscFormat::Dvd
+        } else {
+            DiscFormat::Unknown
+        };
+        let encrypted =
+            udf_fs.find_dir("/AACS").is_some() || udf_fs.find_dir("/BDMV/AACS").is_some();
+        let layers = if capacity > 24_000_000 { 2 } else { 1 };
+
+        Ok(DiscId {
+            volume_id: udf_fs.volume_id,
+            meta_title,
+            format,
+            capacity_sectors: capacity,
+            encrypted,
+            layers,
+        })
+    }
+
     /// Disc capacity in GB
     pub fn capacity_gb(&self) -> f64 {
         self.capacity_sectors as f64 * 2048.0 / (1024.0 * 1024.0 * 1024.0)
     }
 
+    /// Read UDF filesystem and set up buffered reader with metadata prefetched.
+    /// Shared setup for both identify() and scan().
+    fn read_udf(session: &mut Drive) -> Result<(u32, udf::BufferedSectorReader<'_>, udf::UdfFs)> {
+        let capacity = Self::read_capacity(session).unwrap_or(0);
+        let batch = detect_max_batch_sectors(session.device_path());
+        let mut buffered = udf::BufferedSectorReader::new(session, batch);
+        let udf_fs = udf::read_filesystem(&mut buffered)?;
+        buffered.prefetch(udf_fs.metadata_start(), udf_fs.metadata_sectors());
+        Ok((capacity, buffered, udf_fs))
+    }
+
     /// Scan a disc -- parse filesystem, playlists, streams, and set up AACS decryption.
     ///
     /// This is the main entry point. After scan(), the Disc is ready:
@@ -931,18 +1001,14 @@ impl Disc {
     ///   - content can be read and decrypted transparently
     ///
     /// Scan a disc. One pipeline, one order:
-    ///   1. Read capacity
-    ///   2. Read UDF filesystem
-    ///   3. Resolve AACS keys (all via UDF, no SCSI commands)
-    ///   4. Parse playlists + streams
-    ///   5. Apply labels
+    ///   1. Read capacity + UDF filesystem
+    ///   2. AACS handshake + key resolution
+    ///   3. Parse playlists + streams
+    ///   4. Apply labels
     ///
     /// The session must be open and unlocked (Drive::open handles this).
     /// All disc reads use standard READ(10) via UDF -- no vendor SCSI commands.
     pub fn scan(session: &mut Drive, opts: &ScanOptions) -> Result<Self> {
-        // READ CAPACITY may fail in LibreDrive mode — proceed with 0 and estimate later
-        let capacity = Self::read_capacity(session).unwrap_or(0);
-
         // AACS handshake (Blu-ray/UHD)
         let handshake = Self::do_handshake(session, opts);
 
@@ -950,7 +1016,16 @@ impl Disc {
         // (BD/UHD speed is set by firmware init, but DVD needs explicit SET CD SPEED)
         session.set_speed(0xFFFF);
 
-        let mut disc = Self::scan_with(session, capacity, handshake, opts)?;
+        // Read UDF filesystem with buffered sector reader
+        let (capacity, mut buffered, udf_fs) = Self::read_udf(session)?;
+
+        // Pre-read all small file sectors (AACS, MPLS, CLPI, META, *.bdmv).
+        // Without this, each read_file() triggers individual SCSI commands at 500ms each.
+        if let Ok(ranges) = udf_fs.metadata_sector_ranges(&mut buffered) {
+            buffered.prefetch_ranges(&ranges);
+        }
+
+        let mut disc = Self::scan_with(&mut buffered, capacity, handshake, opts, udf_fs)?;
 
         // CSS key extraction for DVDs (bus auth → disc key → title key).
         // Must be a single auth session — can't call authenticate() separately.
@@ -958,18 +1033,17 @@ impl Disc {
             && disc.content_format == ContentFormat::MpegPs
             && !disc.titles.is_empty()
         {
-            let lba = disc.titles[0]
-                .extents
-                .iter()
-                .find_map(|ext| {
-                    let mut buf = vec![0u8; 2048];
-                    if session.read_sectors(ext.start_lba, 1, &mut buf).is_ok() {
-                        if crate::css::is_scrambled(&buf) {
-                            return Some(ext.start_lba);
-                        }
-                    }
-                    None
-                });
+            let lba = disc.titles[0].extents.iter().find_map(|ext| {
+                let mut buf = vec![0u8; 2048];
+                if session
+                    .read_sectors(ext.start_lba, 1, &mut buf, true)
+                    .is_ok()
+                    && crate::css::is_scrambled(&buf)
+                {
+                    return Some(ext.start_lba);
+                }
+                None
+            });
 
             if let Some(lba) = lba {
                 if let Ok(title_key) =
@@ -991,7 +1065,8 @@ impl Disc {
         capacity: u32,
         opts: &ScanOptions,
     ) -> Result<Self> {
-        Self::scan_with(reader, capacity, None, opts)
+        let udf_fs = udf::read_filesystem(reader)?;
+        Self::scan_with(reader, capacity, None, opts, udf_fs)
     }
 
     /// Core scan pipeline — works with any SectorReader.
@@ -1000,10 +1075,8 @@ impl Disc {
         capacity: u32,
         handshake: Option<HandshakeResult>,
         opts: &ScanOptions,
+        udf_fs: udf::UdfFs,
     ) -> Result<Self> {
-        // 1. UDF filesystem
-        let udf_fs = udf::read_filesystem(reader)?;
-
         // 2. Resolve encryption (AACS, CSS, or none)
         let encrypted =
             udf_fs.find_dir("/AACS").is_some() || udf_fs.find_dir("/BDMV/AACS").is_some();
@@ -1041,6 +1114,7 @@ impl Disc {
         // 4. Metadata + labels
         let meta_title = Self::read_meta_title(reader, &udf_fs);
         crate::labels::apply(reader, &udf_fs, &mut titles);
+        crate::labels::fill_defaults(&mut titles);
 
         // 5. Derive format, layers, region
         let format = Self::detect_format(&titles);
@@ -1138,94 +1212,550 @@ impl Disc {
 
     /// Raw sector copy — write the entire disc image to a file.
     ///
-    /// This is NOT a stream operation. It copies sectors 0→capacity byte-for-byte,
-    /// producing a valid ISO/UDF image. The disc's filesystem structure is preserved.
+    /// NOT a stream operation. Copies sectors 0→capacity byte-for-byte producing
+    /// a valid ISO/UDF image. Records progress in a ddrescue-format mapfile at
+    /// `path + ".mapfile"` — flushed every block for crash-safe resume.
     ///
-    /// If `decrypt` is true and keys are available, sectors are decrypted on the fly.
-    /// If `resume` is true and the file already exists, resumes from the last safe position.
-    ///
-    /// `on_progress` is called periodically with (bytes_done, total_bytes).
+    /// # Options
+    /// - **default** (all false): behavior matches pre-v0.11.21 — uses full
+    ///   drive recovery (may take minutes per bad sector), aborts on error.
+    ///   Mapfile is produced as a side-effect.
+    /// - **skip_on_error**: zero-fill bad blocks in the ISO, mark them in the
+    ///   mapfile, and continue. Uses fast reads (no drive-level recovery loop).
+    /// - **skip_forward** (implies skip_on_error): on block failure, also skip
+    ///   forward by an exponentially-growing amount, marking the jumped region
+    ///   as `non-trimmed` for later trimming/scraping by `Disc::patch`.
+    /// - **resume**: if the mapfile exists, resume from its state — only
+    ///   `non-tried` ranges are read. Without `resume`, a fresh mapfile is
+    ///   written and the ISO recreated from scratch.
     pub fn copy(
         &self,
         reader: &mut dyn SectorReader,
         path: &std::path::Path,
-        decrypt: bool,
-        resume: bool,
-        batch_sectors: Option<u16>,
-        on_progress: Option<&dyn Fn(u64, u64)>,
-    ) -> Result<()> {
+        opts: &CopyOptions,
+    ) -> Result<CopyResult> {
         use std::io::{Seek, SeekFrom, Write};
 
         let total_bytes = self.capacity_sectors as u64 * 2048;
-        let keys = if decrypt {
+        let keys = if opts.decrypt {
             self.decrypt_keys()
         } else {
             crate::decrypt::DecryptKeys::None
         };
 
-        // Resume: check existing file
-        let (start_lba, file) = if resume {
-            match std::fs::metadata(path) {
-                Ok(meta) if meta.len() > 0 => {
-                    let safe_sectors = (meta.len() / 2048).saturating_sub(5) as u32;
-                    let mut f = std::fs::OpenOptions::new()
-                        .write(true)
-                        .open(path)
-                        .map_err(|e| Error::IoError { source: e })?;
-                    let resume_pos = safe_sectors as u64 * 2048;
-                    f.set_len(resume_pos)
-                        .map_err(|e| Error::IoError { source: e })?;
-                    f.seek(SeekFrom::End(0))
-                        .map_err(|e| Error::IoError { source: e })?;
-                    (safe_sectors, f)
-                }
-                _ => {
-                    let f =
-                        std::fs::File::create(path).map_err(|e| Error::IoError { source: e })?;
-                    (0u32, f)
-                }
-            }
-        } else {
-            let f = std::fs::File::create(path).map_err(|e| Error::IoError { source: e })?;
-            (0u32, f)
-        };
-
-        let mut writer = std::io::BufWriter::with_capacity(4 * 1024 * 1024, file);
-        let batch: u16 = batch_sectors.unwrap_or(DEFAULT_BATCH_SECTORS);
-        let mut lba = start_lba;
-        let mut bytes_done = start_lba as u64 * 2048;
-        let mut buf = vec![0u8; batch as usize * 2048];
-
-        while lba < self.capacity_sectors {
-            let remaining = self.capacity_sectors - lba;
-            let count = remaining.min(batch as u32) as u16;
-            let bytes = count as usize * 2048;
-
-            reader
-                .read_sectors(lba, count, &mut buf[..bytes])
-                .map_err(|e| Error::IoError {
-                    source: std::io::Error::other(e.to_string()),
-                })?;
-
-            // Decrypt if requested
-            if decrypt {
-                crate::decrypt::decrypt_sectors(&mut buf[..bytes], &keys, 0)?;
-            }
-
-            writer
-                .write_all(&buf[..bytes])
+        // Mapfile: load if resuming, else wipe + recreate.
+        let mapfile_path = mapfile_path_for(path);
+        if !opts.resume {
+            let _ = std::fs::remove_file(&mapfile_path);
+        }
+        let mut map =
+            mapfile::Mapfile::open_or_create(&mapfile_path, total_bytes, env!("CARGO_PKG_VERSION"))
                 .map_err(|e| Error::IoError { source: e })?;
 
-            lba += count as u32;
-            bytes_done += bytes as u64;
+        // ISO file: if resuming and mapfile has Finished ranges, open existing;
+        // otherwise create fresh and pre-size to total_bytes (sparse holes for
+        // non-tried regions).
+        let file = if opts.resume
+            && std::fs::metadata(path)
+                .map(|m| m.len() > 0)
+                .unwrap_or(false)
+        {
+            std::fs::OpenOptions::new()
+                .write(true)
+                .open(path)
+                .map_err(|e| Error::IoError { source: e })?
+        } else {
+            let f = std::fs::File::create(path).map_err(|e| Error::IoError { source: e })?;
+            f.set_len(total_bytes)
+                .map_err(|e| Error::IoError { source: e })?;
+            f
+        };
 
-            if let Some(ref cb) = on_progress {
-                cb(bytes_done, total_bytes);
+        let mut file = file;
+        let batch: u16 = match opts.batch_sectors {
+            Some(b) => b,
+            None if opts.skip_forward => 32, // 64 KB = BD ECC block size
+            None => DEFAULT_BATCH_SECTORS,
+        };
+
+        // Skip-forward state.
+        let skip_init = 256 * 1024u64; // 256 KB
+        let skip_max = (total_bytes / 100).max(skip_init); // cap at 1% of disc
+        let mut skip_size = skip_init;
+
+        let mut buf = vec![0u8; batch as usize * 2048];
+        let mut bytes_done = 0u64;
+        let mut halt_requested = false;
+        let copy_t0 = std::time::Instant::now();
+        let mut iter_count: u64 = 0;
+        let mut read_ok_count: u64 = 0;
+        let mut read_err_count: u64 = 0;
+        let mut last_log_iter: u64 = 0;
+        tracing::trace!(
+            target: "freemkv::disc",
+            phase = "copy_start",
+            total_bytes,
+            batch,
+            skip_init,
+            skip_max,
+            "Disc::copy entered"
+        );
+
+        // Iterate over not-yet-finished regions from the mapfile. We re-read the
+        // mapfile after each block because record() mutates the region list.
+        'outer: loop {
+            let regions_to_do = map.ranges_with(&[
+                mapfile::SectorStatus::NonTried,
+                mapfile::SectorStatus::NonTrimmed,
+                mapfile::SectorStatus::NonScraped,
+            ]);
+            tracing::trace!(
+                target: "freemkv::disc",
+                phase = "outer_loop",
+                regions_remaining = regions_to_do.len(),
+                "Disc::copy outer iter"
+            );
+            if regions_to_do.is_empty() {
+                break;
+            }
+            // Only process the first NonTried range per outer pass; skip_forward
+            // may turn others into NonTrimmed which we DO NOT re-enter here —
+            // Disc::patch handles those.
+            let Some((region_pos, region_size)) = map.next_with(0, mapfile::SectorStatus::NonTried)
+            else {
+                break;
+            };
+            let region_end = region_pos + region_size;
+            let mut pos = region_pos;
+            tracing::trace!(
+                target: "freemkv::disc",
+                phase = "region_enter",
+                region_pos,
+                region_size,
+                region_end,
+                "entering NonTried region"
+            );
+
+            while pos < region_end {
+                if let Some(ref h) = opts.halt {
+                    if h.load(std::sync::atomic::Ordering::Relaxed) {
+                        halt_requested = true;
+                        break 'outer;
+                    }
+                }
+                let block_bytes = (region_end - pos).min(batch as u64 * 2048);
+                let lba = (pos / 2048) as u32;
+                let count = (block_bytes / 2048) as u16;
+                let bytes = count as usize * 2048;
+
+                let recovery = !opts.skip_on_error; // fast reads when skipping
+                iter_count += 1;
+                let read_t0 = std::time::Instant::now();
+                let read_ok = reader
+                    .read_sectors(lba, count, &mut buf[..bytes], recovery)
+                    .is_ok();
+                let read_elapsed_ms = read_t0.elapsed().as_millis() as u64;
+
+                if read_ok {
+                    read_ok_count += 1;
+                    if opts.decrypt {
+                        crate::decrypt::decrypt_sectors(&mut buf[..bytes], &keys, 0)?;
+                    }
+                    file.seek(SeekFrom::Start(pos))
+                        .map_err(|e| Error::IoError { source: e })?;
+                    file.write_all(&buf[..bytes])
+                        .map_err(|e| Error::IoError { source: e })?;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::Finished)
+                        .map_err(|e| Error::IoError { source: e })?;
+                    bytes_done = bytes_done.saturating_add(block_bytes);
+                    skip_size = skip_init; // reset after success
+                    pos += block_bytes;
+                } else if opts.skip_on_error {
+                    read_err_count += 1;
+                    // Zero-fill this block, mark non-trimmed for later patch trim.
+                    buf[..bytes].fill(0);
+                    file.seek(SeekFrom::Start(pos))
+                        .map_err(|e| Error::IoError { source: e })?;
+                    file.write_all(&buf[..bytes])
+                        .map_err(|e| Error::IoError { source: e })?;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::NonTrimmed)
+                        .map_err(|e| Error::IoError { source: e })?;
+                    pos += block_bytes;
+
+                    if opts.skip_forward && pos < region_end {
+                        // Skip ahead; mark skipped bytes as non-trimmed too.
+                        let jump = skip_size.min(region_end - pos);
+                        if jump > 0 {
+                            map.record(pos, jump, mapfile::SectorStatus::NonTrimmed)
+                                .map_err(|e| Error::IoError { source: e })?;
+                            pos += jump;
+                        }
+                        skip_size = (skip_size * 2).min(skip_max);
+                    }
+                } else {
+                    // Current behavior (pre-0.11.21): abort on first bad sector.
+                    return Err(Error::DiscRead { sector: lba as u64 });
+                }
+
+                // Throttled iter telemetry — every 100 inner iterations.
+                if iter_count - last_log_iter >= 100 {
+                    last_log_iter = iter_count;
+                    let stats = map.stats();
+                    tracing::trace!(
+                        target: "freemkv::disc",
+                        phase = "iter_progress",
+                        iter_count,
+                        read_ok_count,
+                        read_err_count,
+                        last_read_ms = read_elapsed_ms,
+                        pos,
+                        region_end,
+                        skip_size,
+                        bytes_good = stats.bytes_good,
+                        bytes_pending = stats.bytes_pending,
+                        copy_elapsed_ms = copy_t0.elapsed().as_millis() as u64,
+                        "Disc::copy inner iter"
+                    );
+                }
+
+                if let Some(reporter) = opts.progress {
+                    let stats = map.stats();
+                    reporter.report(&crate::progress::PassProgress {
+                        kind: crate::progress::PassKind::Sweep,
+                        work_done: pos,
+                        work_total: total_bytes,
+                        bytes_good_total: stats.bytes_good,
+                        bytes_total_disc: total_bytes,
+                    });
+                }
             }
         }
 
-        writer.flush().map_err(|e| Error::IoError { source: e })?;
-        Ok(())
+        file.sync_all().map_err(|e| Error::IoError { source: e })?;
+        let stats = map.stats();
+        tracing::trace!(
+            target: "freemkv::disc",
+            phase = "copy_done",
+            iter_count,
+            read_ok_count,
+            read_err_count,
+            bytes_good = stats.bytes_good,
+            bytes_pending = stats.bytes_pending,
+            halted = halt_requested,
+            copy_elapsed_ms = copy_t0.elapsed().as_millis() as u64,
+            "Disc::copy returning"
+        );
+        Ok(CopyResult {
+            bytes_total: total_bytes,
+            bytes_good: stats.bytes_good,
+            bytes_unreadable: stats.bytes_unreadable,
+            bytes_pending: stats.bytes_pending,
+            complete: stats.bytes_pending == 0 && !halt_requested,
+            halted: halt_requested,
+        })
+    }
+}
+
+/// Options for `Disc::copy`. All fields default to the pre-v0.11.21 behavior
+/// (recovery reads, abort on bad sector).
+#[derive(Default)]
+pub struct CopyOptions<'a> {
+    pub decrypt: bool,
+    /// Resume from existing mapfile + ISO if present. Without this, any
+    /// existing mapfile is wiped and the ISO recreated.
+    pub resume: bool,
+    /// Override the default block size in sectors. Callers should resolve
+    /// this with `detect_max_batch_sectors(device_path)` for live drives.
+    /// When `None`, falls back to 32 sectors (64 KB BD ECC block) in
+    /// `skip_forward` mode or `DEFAULT_BATCH_SECTORS=60` otherwise.
+    pub batch_sectors: Option<u16>,
+    /// Zero-fill bad blocks in the ISO, mark them in the mapfile, continue.
+    /// Uses fast reads (no drive-level recovery loop).
+    pub skip_on_error: bool,
+    /// ddrescue-style exponential skip-forward on block failure. Implies
+    /// `skip_on_error`. The skipped region is marked `non-trimmed` for later
+    /// trimming/scraping by `Disc::patch`.
+    pub skip_forward: bool,
+    /// Per-iteration progress reporter. v0.13.16 architecture: the library
+    /// emits a single `PassProgress` shape via the `Progress` trait;
+    /// consumers compute their own derived percentages / ETAs from it. No
+    /// more positional `(bytes_good, pos, total)` callbacks.
+    pub progress: Option<&'a dyn crate::progress::Progress>,
+    pub halt: Option<std::sync::Arc<std::sync::atomic::AtomicBool>>,
+}
+
+/// Result of `Disc::copy`. `complete=true` means every byte reached a terminal
+/// state (Finished or Unreadable). `complete=false` means there's still pending
+/// work (halt, abort, or non-tried ranges) that `Disc::patch` or a resumed
+/// `Disc::copy` would continue.
+#[derive(Debug, Clone, Copy)]
+pub struct CopyResult {
+    pub bytes_total: u64,
+    pub bytes_good: u64,
+    pub bytes_unreadable: u64,
+    pub bytes_pending: u64,
+    pub complete: bool,
+    pub halted: bool,
+}
+
+/// Sidecar mapfile path for a given ISO path — `foo.iso` → `foo.iso.mapfile`.
+pub fn mapfile_path_for(iso_path: &std::path::Path) -> std::path::PathBuf {
+    let mut s = iso_path.as_os_str().to_os_string();
+    s.push(".mapfile");
+    std::path::PathBuf::from(s)
+}
+
+/// Options for `Disc::patch`. Idempotent — each call is one patch attempt.
+#[derive(Default)]
+pub struct PatchOptions<'a> {
+    pub decrypt: bool,
+    /// Sector-granularity block size for retries. Defaults to 1 sector (2 KB).
+    pub block_sectors: Option<u16>,
+    /// Use full drive-level recovery on each read (slow but thorough). Defaults
+    /// to true — patch is the pass where we *want* the drive to try hard.
+    pub full_recovery: bool,
+    /// Walk bad ranges in reverse order, and within each range walk sectors
+    /// from high to low LBA. Useful for drives that wedge after a forward
+    /// read of a bad sector — approaching the post-bad-zone from end-of-disc
+    /// reads good sectors before the drive sees a bad one.
+    pub reverse: bool,
+    /// Bail out early if this many consecutive read failures occur with zero
+    /// successful reads in the same pass — i.e. the drive is wedged on the
+    /// bad zone and won't recover during this attempt. `0` disables the
+    /// guard (run to completion or halt).
+    pub wedged_threshold: u64,
+    /// Per-iteration progress reporter. See `CopyOptions::progress`.
+    pub progress: Option<&'a dyn crate::progress::Progress>,
+    pub halt: Option<std::sync::Arc<std::sync::atomic::AtomicBool>>,
+}
+
+/// Result of `Disc::patch` — how many bad bytes were recovered, plus
+/// per-block counters for diagnosing why a pass made or didn't make progress.
+#[derive(Debug, Clone, Copy)]
+pub struct PatchResult {
+    pub bytes_total: u64,
+    pub bytes_good: u64,
+    pub bytes_unreadable: u64,
+    pub bytes_pending: u64,
+    pub bytes_recovered_this_pass: u64,
+    pub halted: bool,
+    /// Total inner-loop iterations this pass (one per block attempted).
+    pub blocks_attempted: u64,
+    /// Reads that returned Ok and were promoted to `Finished`.
+    pub blocks_read_ok: u64,
+    /// Reads that returned Err and were marked `Unreadable`.
+    pub blocks_read_failed: u64,
+    /// Pass exited early because `wedged_threshold` consecutive failures
+    /// occurred with zero successful reads — drive appears wedged on the
+    /// bad zone for this pass.
+    pub wedged_exit: bool,
+}
+
+impl Disc {
+    /// Patch an existing ISO using its sidecar mapfile. Re-reads every range
+    /// that's not yet `+` (Finished) and writes successful bytes into the ISO
+    /// at their exact offsets. Updates mapfile entries as it goes.
+    ///
+    /// Idempotent — call repeatedly to apply more retry attempts. Stops early
+    /// if a pass recovered zero bytes (no point continuing).
+    pub fn patch(
+        &self,
+        reader: &mut dyn SectorReader,
+        path: &std::path::Path,
+        opts: &PatchOptions,
+    ) -> Result<PatchResult> {
+        use std::io::{Seek, SeekFrom, Write};
+
+        let mapfile_path = mapfile_path_for(path);
+        let mut map =
+            mapfile::Mapfile::load(&mapfile_path).map_err(|e| Error::IoError { source: e })?;
+        let total_bytes = map.total_size();
+        let keys = if opts.decrypt {
+            self.decrypt_keys()
+        } else {
+            crate::decrypt::DecryptKeys::None
+        };
+
+        let mut file = std::fs::OpenOptions::new()
+            .write(true)
+            .open(path)
+            .map_err(|e| Error::IoError { source: e })?;
+
+        let block_sectors = opts.block_sectors.unwrap_or(1);
+        let recovery = opts.full_recovery;
+
+        let bytes_good_before = map.stats().bytes_good;
+        let mut halted = false;
+        let mut wedged_exit = false;
+        let mut blocks_attempted: u64 = 0;
+        let mut blocks_read_ok: u64 = 0;
+        let mut blocks_read_failed: u64 = 0;
+        let mut consecutive_failures: u64 = 0;
+        let mut buf = vec![0u8; block_sectors as usize * 2048];
+
+        // Collect bad ranges up front. Iterating while mutating is fragile;
+        // each recorded change is persisted, so resume works even if we crash
+        // mid-loop.
+        let mut bad_ranges = map.ranges_with(&[
+            mapfile::SectorStatus::NonTried,
+            mapfile::SectorStatus::NonTrimmed,
+            mapfile::SectorStatus::NonScraped,
+            mapfile::SectorStatus::Unreadable,
+        ]);
+        // Reverse mode: walk ranges from highest LBA to lowest.
+        if opts.reverse {
+            bad_ranges.reverse();
+        }
+        // work_total = sum of all bad-range bytes. on_progress's third arg
+        // is this value; the second arg (work_done) is incremented per block
+        // attempted. UI consumers (autorip) compute pass_progress_pct =
+        // work_done / work_total — true 0..100% per pass per RIP_DESIGN.md §16.
+        let work_total: u64 = bad_ranges.iter().map(|(_, sz)| *sz).sum();
+        let mut work_done: u64 = 0;
+        tracing::trace!(
+            target: "freemkv::disc",
+            phase = "patch_start",
+            block_sectors,
+            recovery,
+            reverse = opts.reverse,
+            wedged_threshold = opts.wedged_threshold,
+            num_ranges = bad_ranges.len(),
+            work_total,
+            "Disc::patch entered"
+        );
+
+        'outer: for (range_pos, range_size) in bad_ranges {
+            let end = range_pos + range_size;
+            // In reverse mode, walk this range from end - block_bytes back to range_pos.
+            // Each iteration emits the block ending at `block_end` (so reads land on
+            // increasing LBAs internally; we just choose blocks back-to-front).
+            let mut block_end = if opts.reverse { end } else { range_pos };
+            loop {
+                if let Some(ref h) = opts.halt {
+                    if h.load(std::sync::atomic::Ordering::Relaxed) {
+                        halted = true;
+                        break 'outer;
+                    }
+                }
+                // Compute block boundaries based on direction.
+                let (pos, block_bytes) = if opts.reverse {
+                    if block_end <= range_pos {
+                        break;
+                    }
+                    let span = (block_end - range_pos).min(block_sectors as u64 * 2048);
+                    (block_end - span, span)
+                } else {
+                    if block_end >= end {
+                        break;
+                    }
+                    let span = (end - block_end).min(block_sectors as u64 * 2048);
+                    (block_end, span)
+                };
+                let lba = (pos / 2048) as u32;
+                let count = (block_bytes / 2048) as u16;
+                let bytes = count as usize * 2048;
+                blocks_attempted += 1;
+                let read_ok = reader
+                    .read_sectors(lba, count, &mut buf[..bytes], recovery)
+                    .is_ok();
+                if read_ok {
+                    blocks_read_ok += 1;
+                    consecutive_failures = 0;
+                    if opts.decrypt {
+                        crate::decrypt::decrypt_sectors(&mut buf[..bytes], &keys, 0)?;
+                    }
+                    file.seek(SeekFrom::Start(pos))
+                        .map_err(|e| Error::IoError { source: e })?;
+                    file.write_all(&buf[..bytes])
+                        .map_err(|e| Error::IoError { source: e })?;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::Finished)
+                        .map_err(|e| Error::IoError { source: e })?;
+                } else {
+                    blocks_read_failed += 1;
+                    consecutive_failures += 1;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::Unreadable)
+                        .map_err(|e| Error::IoError { source: e })?;
+                }
+                // Advance block_end in chosen direction.
+                if opts.reverse {
+                    block_end = block_end.saturating_sub(block_bytes);
+                } else {
+                    block_end += block_bytes;
+                }
+
+                // Wedged-drive early-exit: many consecutive failures with zero
+                // recovered bytes this pass means the drive is stuck and won't
+                // produce data this pass. Save the wallclock budget for productive
+                // grinding; future passes (with smaller block size, reverse, or
+                // after settle) may still recover.
+                if opts.wedged_threshold > 0
+                    && consecutive_failures >= opts.wedged_threshold
+                    && blocks_read_ok == 0
+                {
+                    tracing::trace!(
+                        target: "freemkv::disc",
+                        phase = "patch_wedged_exit",
+                        consecutive_failures,
+                        blocks_read_failed,
+                        "Disc::patch giving up — drive appears wedged"
+                    );
+                    wedged_exit = true;
+                    break 'outer;
+                }
+
+                // Track work done in this pass for the per-pass progress bar.
+                // Each block iterated counts as work, regardless of read
+                // outcome — a failed retry is still progress through the
+                // bad-range walk.
+                work_done = work_done.saturating_add(block_bytes);
+
+                if let Some(reporter) = opts.progress {
+                    let s = map.stats();
+                    let kind = if block_sectors == 1 {
+                        crate::progress::PassKind::Scrape {
+                            reverse: opts.reverse,
+                        }
+                    } else {
+                        crate::progress::PassKind::Trim {
+                            reverse: opts.reverse,
+                        }
+                    };
+                    reporter.report(&crate::progress::PassProgress {
+                        kind,
+                        work_done,
+                        work_total,
+                        bytes_good_total: s.bytes_good,
+                        bytes_total_disc: total_bytes,
+                    });
+                }
+            }
+        }
+
+        file.sync_all().map_err(|e| Error::IoError { source: e })?;
+        let stats = map.stats();
+        tracing::trace!(
+            target: "freemkv::disc",
+            phase = "patch_done",
+            blocks_attempted,
+            blocks_read_ok,
+            blocks_read_failed,
+            wedged_exit,
+            halted,
+            bytes_recovered = stats.bytes_good.saturating_sub(bytes_good_before),
+            "Disc::patch returning"
+        );
+        Ok(PatchResult {
+            bytes_total: total_bytes,
+            bytes_good: stats.bytes_good,
+            bytes_unreadable: stats.bytes_unreadable,
+            bytes_pending: stats.bytes_pending,
+            bytes_recovered_this_pass: stats.bytes_good.saturating_sub(bytes_good_before),
+            halted,
+            blocks_attempted,
+            blocks_read_ok,
+            blocks_read_failed,
+            wedged_exit,
+        })
     }
 }
 

src/drive/linux.rs

@@ -10,11 +10,6 @@ pub fn find_drives() -> Vec<(String, DriveId)> {
         if !std::path::Path::new(&path).exists() {
             continue;
         }
-        // Skip stale device nodes — sysfs entry must exist
-        let sysfs = format!("/sys/class/scsi_generic/sg{i}/device/model");
-        if !std::path::Path::new(&sysfs).exists() {
-            continue;
-        }
         if let Ok(mut transport) = crate::scsi::open(std::path::Path::new(&path)) {
             if let Ok(id) = DriveId::from_drive(transport.as_mut()) {
                 if !id.raw_inquiry.is_empty() && (id.raw_inquiry[0] & 0x1F) == 0x05 {

src/drive/mod.rs

@@ -8,21 +8,27 @@
 
 pub mod capture;
 
+// Per-platform discovery helpers (the `pub(crate)` `find_drives` /
+// equivalents). Crate-public so `scsi/{linux,macos,windows}.rs` can
+// reuse the existing enumeration logic when shaping `DriveInfo`.
 #[cfg(target_os = "linux")]
-mod linux;
+pub(crate) mod linux;
 #[cfg(target_os = "macos")]
-mod macos;
+pub(crate) mod macos;
 #[cfg(windows)]
-mod windows;
+pub(crate) mod windows;
 
 use crate::error::{Error, Result};
+use crate::event::{Event, EventKind};
 use crate::identity::DriveId;
-use crate::platform::mt1959::Mt1959;
 use crate::platform::PlatformDriver;
+use crate::platform::mt1959::Mt1959;
 use crate::profile::{self, DriveProfile};
 use crate::scsi::ScsiTransport;
 use crate::sector::SectorReader;
 use std::path::Path;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
 
 /// Physical state of the drive tray and disc.
 #[derive(Debug, Clone, Copy, PartialEq)]
@@ -47,9 +53,6 @@ const SCSI_GET_EVENT_STATUS: u8 = 0x4A;
 const SCSI_MODE_SENSE: u8 = 0x5A;
 const SCSI_REPORT_KEY: u8 = 0xA4;
 
-/// Recovery state after a read error — stay at min speed for N bytes.
-const RECOVERY_WINDOW: u64 = 500 * 1024 * 1024; // 500 MB
-
 /// Optical disc drive session -- open, identify, unlock, and read.
 pub struct Drive {
     scsi: Box<dyn ScsiTransport>,
@@ -58,9 +61,10 @@ pub struct Drive {
     pub platform: Option<profile::Platform>,
     pub drive_id: DriveId,
     device_path: String,
-    /// Bytes remaining in the min-speed recovery window.
-    /// After a read error, we stay at min speed for RECOVERY_WINDOW bytes.
-    recovery_bytes_remaining: u64,
+    /// Halt flag — when set, Drive::read() bails at the next check point.
+    halt: Arc<AtomicBool>,
+    /// Event handler — fires for read errors and library-level state changes.
+    event_fn: Option<Box<dyn Fn(Event) + Send>>,
 }
 
 impl Drive {
@@ -86,10 +90,65 @@ impl Drive {
             profile,
             drive_id,
             device_path: device.to_string_lossy().to_string(),
-            recovery_bytes_remaining: 0,
+            halt: Arc::new(AtomicBool::new(false)),
+            event_fn: None,
         })
     }
 
+    /// Get a clone of the halt flag. Set to true to interrupt Drive::read().
+    pub fn halt_flag(&self) -> Arc<AtomicBool> {
+        self.halt.clone()
+    }
+
+    /// Halt the drive — Drive::read() will bail at the next check point.
+    pub fn halt(&self) {
+        self.halt.store(true, Ordering::Relaxed);
+    }
+
+    /// Clear the halt flag for the next operation.
+    pub fn clear_halt(&self) {
+        self.halt.store(false, Ordering::Relaxed);
+    }
+
+    /// Set an event handler for read recovery events.
+    pub fn on_event(&mut self, f: impl Fn(Event) + Send + 'static) {
+        self.event_fn = Some(Box::new(f));
+    }
+
+    #[allow(dead_code)] // public on_event registration kept; Drive currently
+    // has no internal emission sites after the 0.13.6 recovery strip.
+    // DiscStream is the BytesRead source. Plan to drop on_event in 0.14.
+    fn emit(&self, kind: EventKind) {
+        if let Some(ref f) = self.event_fn {
+            f(Event { kind });
+        }
+    }
+
+    fn is_halted(&self) -> bool {
+        self.halt.load(Ordering::Relaxed)
+    }
+
+    /// Halt-aware SCSI execute. Returns `Err(Halted)` if the flag is set
+    /// before the command dispatches or by the time it completes. The only
+    /// path to talk to the drive in the recovery hot loop; keeps Drive::read
+    /// free of explicit halt checks.
+    fn checked_exec(
+        &mut self,
+        cdb: &[u8],
+        dir: crate::scsi::DataDirection,
+        buf: &mut [u8],
+        timeout_ms: u32,
+    ) -> Result<crate::scsi::ScsiResult> {
+        if self.is_halted() {
+            return Err(Error::Halted);
+        }
+        let r = self.scsi.as_mut().execute(cdb, dir, buf, timeout_ms)?;
+        if self.is_halted() {
+            return Err(Error::Halted);
+        }
+        Ok(r)
+    }
+
     /// Close the drive cleanly. Unlocks tray, flushes SCSI state, closes fd.
     /// Also runs automatically on Drop as a safety net.
     pub fn close(self) {
@@ -450,20 +509,25 @@ impl Drive {
         }
     }
 
-    /// Read sectors from the disc with automatic error recovery.
+    /// Read sectors from the disc. Single-shot — no inline retries, no
+    /// SCSI reset.
     ///
-    /// On failure: drops to min speed, waits with escalating patience
-    /// (5s, 10s, 15s, 30s, 60s), resets drive between attempts.
-    /// After recovery, stays at min speed for 500 MB before ramping up.
+    /// `recovery=true` bumps the per-CDB timeout to 30 s for the
+    /// `Disc::patch` pass; `recovery=false` uses 1.5 s for `Disc::copy`'s
+    /// fast skip-forward sweep. On any failure returns `Err(DiscRead)`
+    /// immediately. The orchestration layer (`Disc::patch`'s outer loop
+    /// for the patch pass, `DiscStream`'s adaptive batch halving for the
+    /// stream path) handles retries.
     ///
-    /// Returns Err only after all attempts exhausted — user should clean
-    /// the disc and resume.
-    pub fn read(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize> {
-        let timeout_ms = if self.recovery_bytes_remaining > 0 {
-            30_000
-        } else {
-            10_000
-        };
+    /// Inline retry phases (5× gentle + reset+reopen + 5× more) were
+    /// removed in 0.13.6. Per
+    /// `(internal)/postmortems/2026-04-25-stop-wedge-and-zero-kbs.md`,
+    /// the inline reset on the LG BU40N (Initio bridge) wedged drive
+    /// firmware without ever recovering a sector. The remaining recovery
+    /// layers (Disc::patch multi-pass, DiscStream batch halving) do not
+    /// touch the wedge-prone reset path.
+    pub fn read(&mut self, lba: u32, count: u16, buf: &mut [u8], recovery: bool) -> Result<usize> {
+        let timeout_ms = if recovery { 30_000 } else { 1_500 };
         let cdb = [
             crate::scsi::SCSI_READ_10,
             0x00,
@@ -477,69 +541,16 @@ impl Drive {
             0x00,
         ];
 
-        // Normal read
-        if let Ok(result) = self.scsi.as_mut().execute(
+        match self.checked_exec(
             &cdb,
             crate::scsi::DataDirection::FromDevice,
             buf,
             timeout_ms,
         ) {
-            if self.recovery_bytes_remaining > 0 {
-                let bytes_read = count as u64 * 2048;
-                self.recovery_bytes_remaining =
-                    self.recovery_bytes_remaining.saturating_sub(bytes_read);
-                if self.recovery_bytes_remaining == 0 {
-                    self.set_speed(0xFFFF);
-                }
-            }
-            return Ok(result.bytes_transferred);
+            Ok(result) => Ok(result.bytes_transferred),
+            Err(Error::Halted) => Err(Error::Halted),
+            Err(_) => Err(Error::DiscRead { sector: lba as u64 }),
         }
-
-        // Phase 1: gentle — sleep 30s, retry. 5 times.
-        self.set_speed(0);
-
-        for _ in 0..5 {
-            std::thread::sleep(std::time::Duration::from_secs(30));
-
-            if let Ok(result) = self.scsi.as_mut().execute(
-                &cdb,
-                crate::scsi::DataDirection::FromDevice,
-                buf,
-                30_000,
-            ) {
-                self.recovery_bytes_remaining = RECOVERY_WINDOW;
-                return Ok(result.bytes_transferred);
-            }
-        }
-
-        // Phase 2: fresh start — close, reset, open, init.
-        let device = std::path::PathBuf::from(&self.device_path);
-        std::thread::sleep(std::time::Duration::from_secs(5));
-        let _ = crate::scsi::reset(&device);
-        std::thread::sleep(std::time::Duration::from_secs(5));
-        self.scsi = crate::scsi::open(&device)?;
-        let _ = self.init();
-        let _ = self.wait_ready();
-        self.set_speed(0);
-
-        // Phase 3: gentle again on fresh connection — sleep 30s, retry. 5 times.
-        for _ in 0..5 {
-            std::thread::sleep(std::time::Duration::from_secs(30));
-
-            if let Ok(result) = self.scsi.as_mut().execute(
-                &cdb,
-                crate::scsi::DataDirection::FromDevice,
-                buf,
-                30_000,
-            ) {
-                self.recovery_bytes_remaining = RECOVERY_WINDOW;
-                return Ok(result.bytes_transferred);
-            }
-        }
-
-        // Both phases failed.
-        self.recovery_bytes_remaining = RECOVERY_WINDOW;
-        Err(Error::DiscRead { sector: lba as u64 })
     }
 
     /// Read the disc capacity in sectors (2048 bytes each).
@@ -640,8 +651,14 @@ impl Drop for Drive {
 }
 
 impl SectorReader for Drive {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize> {
-        self.read(lba, count, buf)
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        recovery: bool,
+    ) -> Result<usize> {
+        self.read(lba, count, buf, recovery)
     }
 }
 
@@ -660,6 +677,27 @@ pub fn find_drive() -> Option<Drive> {
     find_drives().into_iter().next()
 }
 
+/// Halt-aware sleep primitive — wakes within ~100 ms of `halt` flipping
+/// to true. Kept for the unit tests that cover the slicing behaviour;
+/// production code paths no longer sleep on the recovery hot path
+/// (recovery loop removed in 0.13.6).
+#[cfg(test)]
+fn sleep_until_halted(halt: &AtomicBool, total: std::time::Duration) -> Result<()> {
+    const SLICE: std::time::Duration = std::time::Duration::from_millis(100);
+    let deadline = std::time::Instant::now() + total;
+    loop {
+        if halt.load(Ordering::Relaxed) {
+            return Err(Error::Halted);
+        }
+        let now = std::time::Instant::now();
+        if now >= deadline {
+            return Ok(());
+        }
+        let remaining = deadline - now;
+        std::thread::sleep(remaining.min(SLICE));
+    }
+}
+
 /// Internal: discover drive paths + IDs without opening full Drive objects.
 fn discover_drives() -> Vec<(String, DriveId)> {
     #[cfg(target_os = "linux")]
@@ -700,10 +738,58 @@ fn create_driver(
     match platform {
         profile::Platform::Mt1959A => Ok(Box::new(Mt1959::new(profile.clone(), false))),
         profile::Platform::Mt1959B => Ok(Box::new(Mt1959::new(profile.clone(), true))),
-        profile::Platform::Renesas => Err(Error::UnsupportedDrive {
-            vendor_id: profile.identity.vendor_id.trim().to_string(),
-            product_id: String::new(),
-            product_revision: "Renesas not yet implemented".to_string(),
+        profile::Platform::Renesas => Err(Error::PlatformNotImplemented {
+            platform: "renesas".to_string(),
         }),
     }
 }
+
+#[cfg(test)]
+mod halt_tests {
+    use super::*;
+    use std::time::{Duration, Instant};
+
+    #[test]
+    fn sleep_until_halted_completes_when_not_halted() {
+        let flag = AtomicBool::new(false);
+        let t0 = Instant::now();
+        let r = sleep_until_halted(&flag, Duration::from_millis(150));
+        assert!(r.is_ok());
+        assert!(t0.elapsed() >= Duration::from_millis(140));
+    }
+
+    #[test]
+    fn sleep_until_halted_returns_immediately_if_preflagged() {
+        let flag = AtomicBool::new(true);
+        let t0 = Instant::now();
+        let r = sleep_until_halted(&flag, Duration::from_secs(10));
+        assert!(matches!(r, Err(Error::Halted)));
+        // Must wake within one slice (100 ms) — the whole point of the
+        // primitive is that a 30 s sleep doesn't block Stop.
+        assert!(t0.elapsed() < Duration::from_millis(200));
+    }
+
+    #[test]
+    fn sleep_until_halted_wakes_mid_sleep() {
+        let flag = Arc::new(AtomicBool::new(false));
+        let f2 = flag.clone();
+        let t0 = Instant::now();
+        std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(150));
+            f2.store(true, Ordering::Relaxed);
+        });
+        let r = sleep_until_halted(&flag, Duration::from_secs(10));
+        assert!(matches!(r, Err(Error::Halted)));
+        let waited = t0.elapsed();
+        // Flag flipped at ~150 ms; we wake within one 100 ms slice → <300 ms.
+        assert!(waited < Duration::from_millis(350), "waited {waited:?}");
+        assert!(waited >= Duration::from_millis(140), "waited {waited:?}");
+    }
+
+    #[test]
+    fn sleep_until_halted_zero_duration_is_noop_when_not_halted() {
+        let flag = AtomicBool::new(false);
+        let r = sleep_until_halted(&flag, Duration::ZERO);
+        assert!(r.is_ok());
+    }
+}

src/error.rs

@@ -24,10 +24,15 @@ pub const E_DEVICE_NOT_FOUND: u16 = 1000;
 pub const E_DEVICE_PERMISSION: u16 = 1001;
 pub const E_DEVICE_NOT_READY: u16 = 1002;
 pub const E_DEVICE_RESET_FAILED: u16 = 1003;
+pub const E_SCSI_INTERFACE_UNAVAILABLE: u16 = 1004;
+pub const E_DEVICE_LOCKED: u16 = 1005;
+pub const E_IOKIT_PLUGIN_FAILED: u16 = 1006;
 
 // Profile (2xxx)
 pub const E_UNSUPPORTED_DRIVE: u16 = 2000;
 pub const E_PROFILE_PARSE: u16 = 2002;
+pub const E_UNSUPPORTED_PLATFORM: u16 = 2003;
+pub const E_PLATFORM_NOT_IMPLEMENTED: u16 = 2004;
 
 // Unlock (3xxx)
 pub const E_UNLOCK_FAILED: u16 = 3000;
@@ -41,6 +46,7 @@ pub const E_IO_ERROR: u16 = 5000;
 
 // Disc format (6xxx)
 pub const E_DISC_READ: u16 = 6000;
+pub const E_HALTED: u16 = 6010;
 pub const E_MPLS_PARSE: u16 = 6001;
 pub const E_CLPI_PARSE: u16 = 6002;
 pub const E_UDF_NOT_FOUND: u16 = 6003;
@@ -48,6 +54,7 @@ pub const E_DISC_TITLE_RANGE: u16 = 6005;
 pub const E_IFO_PARSE: u16 = 6007;
 pub const E_MKV_INVALID: u16 = 6008;
 pub const E_NO_STREAMS: u16 = 6009;
+pub const E_MAPFILE_INVALID: u16 = 6011;
 
 // AACS (7xxx)
 pub const E_AACS_NO_KEYS: u16 = 7000;
@@ -83,6 +90,7 @@ pub const E_PES_FRAME_TOO_LARGE: u16 = 9005;
 pub const E_PES_INVALID_MAGIC: u16 = 9006;
 pub const E_ISO_TOO_LARGE: u16 = 9007;
 pub const E_NO_METADATA: u16 = 9008;
+pub const E_DISC_URL_NOT_DIRECT: u16 = 9009;
 
 // ── Error enum ──────────────────────────────────────────────────────────────
 
@@ -102,6 +110,24 @@ pub enum Error {
     DeviceResetFailed {
         path: String,
     },
+    /// Platform-specific SCSI interface couldn't be obtained from the OS
+    /// (macOS: `SCSITaskDeviceInterface` unavailable). The `path` field
+    /// carries the device path; no English commentary on the failure mode.
+    ScsiInterfaceUnavailable {
+        path: String,
+    },
+    /// Device is held by another process / kernel state. `kr` is the
+    /// platform return code (macOS IOReturn, Linux errno-equivalent).
+    DeviceLocked {
+        path: String,
+        kr: u32,
+    },
+    /// macOS IOKit plugin couldn't be created for this device. `kr` is
+    /// the IOReturn code from `IOCreatePlugInInterfaceForService`.
+    IoKitPluginFailed {
+        path: String,
+        kr: u32,
+    },
 
     // Profile (2xxx)
     UnsupportedDrive {
@@ -110,6 +136,16 @@ pub enum Error {
         product_revision: String,
     },
     ProfileParse,
+    /// SCSI transport was requested on an OS without a backend
+    /// implementation. `target` is the `std::env::consts::OS` value.
+    UnsupportedPlatform {
+        target: String,
+    },
+    /// Drive matched a known platform that we haven't implemented yet
+    /// (e.g. Renesas firmware). `platform` is a stable identifier.
+    PlatformNotImplemented {
+        platform: String,
+    },
 
     // Unlock (3xxx)
     UnlockFailed,
@@ -134,6 +170,8 @@ pub enum Error {
     DiscRead {
         sector: u64,
     },
+    /// Drive was halted by caller.
+    Halted,
     MplsParse,
     ClpiParse,
     UdfNotFound {
@@ -146,6 +184,12 @@ pub enum Error {
     IfoParse,
     MkvInvalid,
     NoStreams,
+    /// ddrescue mapfile parse failed. `kind` is a stable, language-neutral
+    /// identifier (e.g. `"status_char"`, `"hex"`); not a translatable
+    /// English message.
+    MapfileInvalid {
+        kind: &'static str,
+    },
 
     // AACS (7xxx)
     AacsNoKeys,
@@ -199,6 +243,10 @@ pub enum Error {
         path: String,
     },
     NoMetadata,
+    /// `disc://` URLs aren't openable through `input()` — callers must use
+    /// `Drive::open() + Disc::scan() + DiscStream::new()` directly. This
+    /// is a structural API constraint, not a parse failure.
+    DiscUrlNotDirect,
 }
 
 impl Error {
@@ -208,13 +256,19 @@ impl Error {
             Error::DevicePermission { .. } => E_DEVICE_PERMISSION,
             Error::DeviceNotReady { .. } => E_DEVICE_NOT_READY,
             Error::DeviceResetFailed { .. } => E_DEVICE_RESET_FAILED,
+            Error::ScsiInterfaceUnavailable { .. } => E_SCSI_INTERFACE_UNAVAILABLE,
+            Error::DeviceLocked { .. } => E_DEVICE_LOCKED,
+            Error::IoKitPluginFailed { .. } => E_IOKIT_PLUGIN_FAILED,
             Error::UnsupportedDrive { .. } => E_UNSUPPORTED_DRIVE,
             Error::ProfileParse => E_PROFILE_PARSE,
+            Error::UnsupportedPlatform { .. } => E_UNSUPPORTED_PLATFORM,
+            Error::PlatformNotImplemented { .. } => E_PLATFORM_NOT_IMPLEMENTED,
             Error::UnlockFailed => E_UNLOCK_FAILED,
             Error::SignatureMismatch { .. } => E_SIGNATURE_MISMATCH,
             Error::ScsiError { .. } => E_SCSI_ERROR,
             Error::IoError { .. } => E_IO_ERROR,
             Error::DiscRead { .. } => E_DISC_READ,
+            Error::Halted => E_HALTED,
             Error::MplsParse => E_MPLS_PARSE,
             Error::ClpiParse => E_CLPI_PARSE,
             Error::UdfNotFound { .. } => E_UDF_NOT_FOUND,
@@ -222,6 +276,7 @@ impl Error {
             Error::IfoParse => E_IFO_PARSE,
             Error::MkvInvalid => E_MKV_INVALID,
             Error::NoStreams => E_NO_STREAMS,
+            Error::MapfileInvalid { .. } => E_MAPFILE_INVALID,
             Error::AacsNoKeys => E_AACS_NO_KEYS,
             Error::AacsCertShort => E_AACS_CERT_SHORT,
             Error::AacsAgidAlloc => E_AACS_AGID_ALLOC,
@@ -251,6 +306,7 @@ impl Error {
             Error::PesInvalidMagic => E_PES_INVALID_MAGIC,
             Error::IsoTooLarge { .. } => E_ISO_TOO_LARGE,
             Error::NoMetadata => E_NO_METADATA,
+            Error::DiscUrlNotDirect => E_DISC_URL_NOT_DIRECT,
         }
     }
 }
@@ -263,6 +319,22 @@ impl std::fmt::Display for Error {
             Error::DevicePermission { path } => write!(f, "E{}: {}", self.code(), path),
             Error::DeviceNotReady { path } => write!(f, "E{}: {}", self.code(), path),
             Error::DeviceResetFailed { path } => write!(f, "E{}: {}", self.code(), path),
+            Error::ScsiInterfaceUnavailable { path } => write!(f, "E{}: {}", self.code(), path),
+            Error::DeviceLocked { path, kr } => {
+                write!(f, "E{}: {} 0x{:08x}", self.code(), path, kr)
+            }
+            Error::IoKitPluginFailed { path, kr } => {
+                write!(f, "E{}: {} 0x{:08x}", self.code(), path, kr)
+            }
+            Error::UnsupportedPlatform { target } => {
+                write!(f, "E{}: {}", self.code(), target)
+            }
+            Error::PlatformNotImplemented { platform } => {
+                write!(f, "E{}: {}", self.code(), platform)
+            }
+            Error::MapfileInvalid { kind } => {
+                write!(f, "E{}: {}", self.code(), kind)
+            }
             Error::UnsupportedDrive {
                 vendor_id,
                 product_id,
@@ -304,6 +376,7 @@ impl std::fmt::Display for Error {
             }
             Error::IoError { source } => write!(f, "E{}: {}", self.code(), source),
             Error::DiscRead { sector } => write!(f, "E{}: {}", self.code(), sector),
+            Error::Halted => write!(f, "E{}", self.code()),
             Error::UdfNotFound { path } => write!(f, "E{}: {}", self.code(), path),
             Error::DiscTitleRange { index, count } => {
                 write!(f, "E{}: {}/{}", self.code(), index, count)
@@ -352,7 +425,10 @@ impl From<Error> for std::io::Error {
             7000..=7999 => std::io::ErrorKind::PermissionDenied,
             8000..=8999 => std::io::ErrorKind::Other,
             9000..=9001 => std::io::ErrorKind::Unsupported,
-            9002..=9009 => std::io::ErrorKind::InvalidInput,
+            9002..=9008 => std::io::ErrorKind::InvalidInput,
+            // 9009 DiscUrlNotDirect: structurally unsupported entry point,
+            // not a parse failure — caller used the wrong API.
+            9009 => std::io::ErrorKind::Unsupported,
             _ => std::io::ErrorKind::Other,
         };
         std::io::Error::new(kind, msg)
@@ -361,3 +437,141 @@ impl From<Error> for std::io::Error {
 
 /// Convenience alias for `Result<T, Error>`.
 pub type Result<T> = std::result::Result<T, Error>;
+
+#[cfg(test)]
+mod tests {
+    //! Smoke tests for the error code → variant mapping. Each new variant
+    //! added in 0.13.0 (English-elimination work) gets a code() check + a
+    //! Display sanity-check (no English words) + an io::ErrorKind mapping
+    //! check. Without these, future drift between the const codes and the
+    //! match arms in `code()` / the From impl could silently miscategorize.
+    use super::*;
+
+    #[test]
+    fn new_variants_have_distinct_codes() {
+        let codes = [
+            Error::ScsiInterfaceUnavailable { path: "p".into() }.code(),
+            Error::DeviceLocked {
+                path: "p".into(),
+                kr: 0,
+            }
+            .code(),
+            Error::IoKitPluginFailed {
+                path: "p".into(),
+                kr: 0,
+            }
+            .code(),
+            Error::UnsupportedPlatform { target: "x".into() }.code(),
+            Error::PlatformNotImplemented {
+                platform: "renesas".into(),
+            }
+            .code(),
+            Error::MapfileInvalid { kind: "hex" }.code(),
+            Error::DiscUrlNotDirect.code(),
+        ];
+        let mut sorted = codes.to_vec();
+        sorted.sort();
+        sorted.dedup();
+        assert_eq!(
+            sorted.len(),
+            codes.len(),
+            "two new variants share a code — check error.rs constants"
+        );
+    }
+
+    #[test]
+    fn display_emits_no_english_words() {
+        // Every variant's Display must be `E{code}: {data}` — no English.
+        // Sample a few of the new variants and a few existing ones to
+        // catch accidental string-stuffing in future edits.
+        let cases: &[(Error, u16)] = &[
+            (
+                Error::ScsiInterfaceUnavailable {
+                    path: "/dev/sg4".into(),
+                },
+                E_SCSI_INTERFACE_UNAVAILABLE,
+            ),
+            (
+                Error::DeviceLocked {
+                    path: "/dev/sg4".into(),
+                    kr: 0xE00002C5,
+                },
+                E_DEVICE_LOCKED,
+            ),
+            (
+                Error::UnsupportedPlatform {
+                    target: "freebsd".into(),
+                },
+                E_UNSUPPORTED_PLATFORM,
+            ),
+            (
+                Error::PlatformNotImplemented {
+                    platform: "renesas".into(),
+                },
+                E_PLATFORM_NOT_IMPLEMENTED,
+            ),
+            (Error::MapfileInvalid { kind: "hex" }, E_MAPFILE_INVALID),
+            (Error::DiscUrlNotDirect, E_DISC_URL_NOT_DIRECT),
+        ];
+        for (e, want_code) in cases {
+            let s = e.to_string();
+            assert!(
+                s.starts_with(&format!("E{}", want_code)),
+                "{:?} display does not lead with code: {}",
+                e,
+                s
+            );
+            // Crude English filter — `Display` should never emit ASCII words
+            // longer than 4 chars (codes/paths/identifiers like `/dev/sg4`,
+            // `renesas`, `freebsd` all pass; "exclusive access denied" would
+            // not).
+            for word in s.split(|c: char| !c.is_ascii_alphabetic()) {
+                assert!(
+                    word.len() <= 8
+                        || word.eq_ignore_ascii_case("renesas")
+                        || word.eq_ignore_ascii_case("freebsd"),
+                    "Display contains suspicious English-looking word `{word}` in `{s}`"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn iokind_mapping_for_new_variants() {
+        use std::io::ErrorKind;
+        let mapped = |e: Error| -> ErrorKind {
+            let io: std::io::Error = e.into();
+            io.kind()
+        };
+        // 1xxx range → NotFound
+        assert_eq!(
+            mapped(Error::ScsiInterfaceUnavailable { path: "p".into() }),
+            ErrorKind::NotFound
+        );
+        assert_eq!(
+            mapped(Error::DeviceLocked {
+                path: "p".into(),
+                kr: 0
+            }),
+            ErrorKind::NotFound
+        );
+        // 2xxx range → Unsupported
+        assert_eq!(
+            mapped(Error::UnsupportedPlatform { target: "x".into() }),
+            ErrorKind::Unsupported
+        );
+        assert_eq!(
+            mapped(Error::PlatformNotImplemented {
+                platform: "x".into()
+            }),
+            ErrorKind::Unsupported
+        );
+        // 6xxx range → InvalidData
+        assert_eq!(
+            mapped(Error::MapfileInvalid { kind: "hex" }),
+            ErrorKind::InvalidData
+        );
+        // 9009 special-cased to Unsupported
+        assert_eq!(mapped(Error::DiscUrlNotDirect), ErrorKind::Unsupported);
+    }
+}

src/event.rs

@@ -80,6 +80,22 @@ pub enum EventKind {
         sector_count: u64,
     },
 
+    /// Sector recovered after a retry (Drive::read multi-phase recovery).
+    SectorRecovered { sector: u64 },
+
+    /// Sector unreadable, zero-filled (skip mode).
+    SectorSkipped { sector: u64 },
+
+    /// Adaptive batch sizer changed the read size.
+    ///
+    /// Fires on shrink (read failed at larger size) and on probe-up
+    /// (enough clean reads to try larger again). Consumers use this to
+    /// display a "recovering" state distinct from "ripping normally".
+    BatchSizeChanged {
+        new_size: u16,
+        reason: BatchSizeReason,
+    },
+
     /// Operation complete.
     Complete {
         /// Total bytes written.
@@ -89,5 +105,14 @@ pub enum EventKind {
     },
 }
 
+/// Why the adaptive batch sizer changed size.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BatchSizeReason {
+    /// Read failed; sizer halved the batch.
+    Shrunk,
+    /// Clean-read streak threshold hit; sizer doubled toward preferred.
+    Probed,
+}
+
 /// A no-op event handler. Ignores all events.
 pub fn ignore(_event: Event) {}

src/ifo.rs

@@ -47,6 +47,8 @@ pub struct DvdTitle {
     pub duration_secs: f64,
     /// Cell sector ranges
     pub cells: Vec<DvdCell>,
+    /// Chapter start times in seconds (derived from program map + cell times)
+    pub chapter_times: Vec<f64>,
     /// Subtitle palette from PGC: 16 entries of [padding, Y, Cb, Cr].
     pub palette: Option<Vec<[u8; 4]>>,
 }
@@ -541,6 +543,39 @@ fn parse_pgc(data: &[u8], pgc_offset: usize, chapters: u16) -> Result<DvdTitle>
         duration_secs
     };
 
+    // Extract chapter times from program map + cell durations
+    // PGC program map offset at 0xE6, maps program_number → first cell_number
+    let chapter_times = {
+        let pgm_map_offset = be_u16(data, pgc_offset + 0xE6).unwrap_or(0) as usize;
+        let nr_of_programs = byte_at(data, pgc_offset + 0x02).unwrap_or(0) as usize;
+        let mut times = Vec::new();
+        if pgm_map_offset > 0 && nr_of_programs > 0 && cell_playback_offset > 0 {
+            let pgm_base = pgc_offset + pgm_map_offset;
+            // Collect cell durations
+            let mut cell_durations = Vec::with_capacity(num_cells);
+            let cell_base = pgc_offset + cell_playback_offset;
+            for i in 0..num_cells {
+                let co = cell_base + i * 24;
+                if co + 8 <= data.len() {
+                    cell_durations.push(bcd_to_secs(&data[co + 4..co + 8]));
+                } else {
+                    cell_durations.push(0.0);
+                }
+            }
+            // Program map: each byte is the first cell number (1-based) for that program
+            for p in 0..nr_of_programs {
+                if pgm_base + p >= data.len() {
+                    break;
+                }
+                let first_cell = data[pgm_base + p] as usize;
+                // Chapter time = sum of cell durations before this program's first cell
+                let time: f64 = cell_durations[..first_cell.saturating_sub(1)].iter().sum();
+                times.push(time);
+            }
+        }
+        times
+    };
+
     // Extract subtitle palette at PGC offset 0xA4: 16 colors × 4 bytes [padding, Y, Cb, Cr]
     let palette = if pgc_offset + 0xA4 + 64 <= data.len() {
         let mut colors = Vec::with_capacity(16);
@@ -562,6 +597,7 @@ fn parse_pgc(data: &[u8], pgc_offset: usize, chapters: u16) -> Result<DvdTitle>
         chapters,
         duration_secs,
         cells,
+        chapter_times,
         palette,
     })
 }
@@ -651,6 +687,7 @@ mod tests {
             chapters: 5,
             duration_secs: 3600.0,
             cells: vec![cell.clone()],
+            chapter_times: Vec::new(),
             palette: None,
         };
         assert_eq!(title.chapters, 5);
@@ -697,12 +734,12 @@ mod tests {
         let mut pgc = vec![0u8; 0xEA];
         pgc[0x02] = 1; // 1 program
         pgc[0x03] = 2; // 2 cells
-                       // 1h 59m 30s at 29.97fps, 0 frames
+        // 1h 59m 30s at 29.97fps, 0 frames
         pgc[0x04] = 0x01; // hours BCD
         pgc[0x05] = 0x59; // minutes BCD
         pgc[0x06] = 0x30; // seconds BCD
         pgc[0x07] = 0b11_000000; // 29.97fps, 0 frames
-                                 // Cell playback info offset at PGC+0xE8
+        // Cell playback info offset at PGC+0xE8
         let cell_offset: u16 = 0xEA; // right after minimum header
         pgc[0xE8] = (cell_offset >> 8) as u8;
         pgc[0xE9] = cell_offset as u8;
@@ -718,7 +755,7 @@ mod tests {
         pgc[co + 21] = 0;
         pgc[co + 22] = 0;
         pgc[co + 23] = 200; // last sector
-                            // Cell 1: sectors 300-400
+        // Cell 1: sectors 300-400
         let co = 0xEA + 24;
         pgc[co + 8] = 0;
         pgc[co + 9] = 0;

src/labels/ctrm.rs

@@ -4,7 +4,7 @@
 //! When both exist, language_streams.txt provides structured types while
 //! menu_base.prop provides stream number → button name mapping.
 
-use super::{vocab, LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType};
+use super::{LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType, vocab};
 use crate::sector::SectorReader;
 use crate::udf::UdfFs;
 use std::collections::HashMap;

src/labels/mod.rs

@@ -17,6 +17,10 @@ use crate::disc::{DiscTitle, Stream};
 use crate::sector::SectorReader;
 use crate::udf::UdfFs;
 
+// Re-exported via crate::disc — the public API surfaces these next to
+// AudioStream/SubtitleStream so callers can map purpose/qualifier to display
+// text in their own locale.
+
 /// A stream label extracted from disc config files.
 #[derive(Debug, Clone)]
 #[allow(dead_code)]
@@ -46,7 +50,6 @@ pub enum StreamLabelType {
 }
 
 #[derive(Debug, Clone, Copy, PartialEq)]
-#[allow(dead_code)]
 pub enum LabelPurpose {
     Normal,
     Commentary,
@@ -99,16 +102,12 @@ pub fn apply(reader: &mut dyn SectorReader, udf: &UdfFs, titles: &mut [DiscTitle
                     if let Some(label) = labels.iter().find(|l| {
                         l.stream_type == StreamLabelType::Audio && l.stream_number == audio_idx
                     }) {
+                        // Structured fields — callers translate purpose to UI text.
+                        a.purpose = label.purpose;
+
+                        // a.label only carries codec/variant info. NEVER any
+                        // English purpose text — the CLI handles that via i18n.
                         let mut parts = Vec::new();
-                        match label.purpose {
-                            LabelPurpose::Commentary => parts.push("Commentary".to_string()),
-                            LabelPurpose::Descriptive => {
-                                parts.push("Descriptive Audio".to_string())
-                            }
-                            LabelPurpose::Score => parts.push("Score".to_string()),
-                            LabelPurpose::Ime => parts.push("IME".to_string()),
-                            LabelPurpose::Normal => {}
-                        }
                         if !label.variant.is_empty() {
                             parts.push(format!("({})", label.variant));
                         }
@@ -117,7 +116,10 @@ pub fn apply(reader: &mut dyn SectorReader, udf: &UdfFs, titles: &mut [DiscTitle
                         }
                         if !parts.is_empty() {
                             a.label = parts.join(" ");
-                        } else if !label.name.is_empty() {
+                        } else if !label.name.is_empty() && label.purpose == LabelPurpose::Normal {
+                            // Only fall back to the parser-supplied display
+                            // name when there's no purpose to flag — the CLI
+                            // handles purpose rendering itself.
                             a.label = label.name.clone();
                         }
                     }
@@ -127,6 +129,7 @@ pub fn apply(reader: &mut dyn SectorReader, udf: &UdfFs, titles: &mut [DiscTitle
                     if let Some(label) = labels.iter().find(|l| {
                         l.stream_type == StreamLabelType::Subtitle && l.stream_number == sub_idx
                     }) {
+                        s.qualifier = label.qualifier;
                         if label.qualifier == LabelQualifier::Forced {
                             s.forced = true;
                         }
@@ -138,6 +141,132 @@ pub fn apply(reader: &mut dyn SectorReader, udf: &UdfFs, titles: &mut [DiscTitle
     }
 }
 
+/// Fill in default labels for any streams that don't have one.
+/// Runs after BD-J label extraction — fills gaps with codec + channel descriptions.
+/// This is the central place for all fallback label generation.
+pub fn fill_defaults(titles: &mut [crate::disc::DiscTitle]) {
+    use crate::disc::Stream;
+
+    for title in titles.iter_mut() {
+        for stream in &mut title.streams {
+            match stream {
+                Stream::Audio(a) if a.label.is_empty() => {
+                    a.label = generate_audio_label(&a.codec, &a.channels, a.secondary);
+                }
+                Stream::Video(v) if v.label.is_empty() => {
+                    v.label =
+                        generate_video_label(&v.codec, v.resolution.pixels(), &v.hdr, v.secondary);
+                }
+                Stream::Subtitle(s) if s.forced => {
+                    // Ensure forced subs are labeled even if BD-J didn't set a name
+                    // (subtitle labels are generally not set — this just marks forced)
+                }
+                _ => {}
+            }
+        }
+    }
+}
+
+fn generate_video_label(
+    codec: &crate::disc::Codec,
+    pixels: (u32, u32),
+    hdr: &crate::disc::HdrFormat,
+    secondary: bool,
+) -> String {
+    use crate::disc::HdrFormat;
+
+    if secondary {
+        // "Dolby Vision EL" is a brand identifier, not English prose, so the
+        // library may emit it. Other "secondary video" wording is a CLI
+        // concern — the library just leaves the label empty.
+        return match hdr {
+            HdrFormat::DolbyVision => "Dolby Vision EL".to_string(),
+            _ => String::new(),
+        };
+    }
+
+    let mut parts = Vec::new();
+
+    // Codec
+    parts.push(codec.name().to_string());
+
+    // Resolution
+    let (w, h) = pixels;
+    let res = if w >= 7680 {
+        "8K"
+    } else if w >= 3840 {
+        "4K"
+    } else if w >= 1920 {
+        "1080p"
+    } else if w >= 1280 {
+        "720p"
+    } else if h >= 576 {
+        "576p"
+    } else if h >= 480 {
+        "480p"
+    } else {
+        ""
+    };
+    if !res.is_empty() {
+        parts.push(res.into());
+    }
+
+    // HDR
+    match hdr {
+        HdrFormat::Sdr => {}
+        _ => parts.push(hdr.name().to_string()),
+    }
+
+    parts.join(" ")
+}
+
+fn generate_audio_label(
+    codec: &crate::disc::Codec,
+    channels: &crate::disc::AudioChannels,
+    _secondary: bool,
+) -> String {
+    use crate::disc::{AudioChannels, Codec};
+
+    // Full marketing names for disc audio codecs.
+    // These are codec brand identifiers, not user-facing English prose.
+    let codec_name = match codec {
+        Codec::TrueHd => "Dolby TrueHD",
+        Codec::Ac3 => "Dolby Digital",
+        Codec::Ac3Plus => "Dolby Digital Plus",
+        Codec::DtsHdMa => "DTS-HD Master Audio",
+        Codec::DtsHdHr => "DTS-HD High Resolution",
+        Codec::Dts => "DTS",
+        Codec::Lpcm => "LPCM",
+        Codec::Aac => "AAC",
+        Codec::Mp2 => "MPEG Audio",
+        Codec::Mp3 => "MP3",
+        Codec::Flac => "FLAC",
+        Codec::Opus => "Opus",
+        _ => return String::new(),
+    };
+
+    // Channel layout
+    let channel_str = match channels {
+        AudioChannels::Mono => "1.0",
+        AudioChannels::Stereo => "2.0",
+        AudioChannels::Stereo21 => "2.1",
+        AudioChannels::Quad => "4.0",
+        AudioChannels::Surround50 => "5.0",
+        AudioChannels::Surround51 => "5.1",
+        AudioChannels::Surround61 => "6.1",
+        AudioChannels::Surround71 => "7.1",
+        AudioChannels::Unknown => "",
+    };
+
+    // The "(Secondary)" suffix is a CLI/UI concern — callers display it from
+    // the AudioStream::secondary bool, not the library.
+    if channel_str.is_empty() {
+        codec_name.to_string()
+    } else {
+        format!("{} {}", codec_name, channel_str)
+    }
+}
+
 fn extract(reader: &mut dyn SectorReader, udf: &UdfFs) -> Vec<StreamLabel> {
     for (_name, detect, parse) in PARSERS {
         if detect(udf) {

src/labels/pixelogic.rs

@@ -5,7 +5,7 @@
 //!
 //! Token format: `{lang}_{codec?}_{purpose?}_{region?}_`
 
-use super::{vocab, LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType};
+use super::{LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType, vocab};
 use crate::sector::SectorReader;
 use crate::udf::UdfFs;
 

src/lib.rs

@@ -88,34 +88,87 @@ pub mod mux;
 pub mod pes;
 pub(crate) mod platform;
 pub mod profile;
+pub mod progress;
 pub mod scsi;
 pub mod sector;
 pub(crate) mod speed;
 pub(crate) mod udf;
+pub mod verify;
 
+// ─── Drive lifecycle ────────────────────────────────────────────────────────
+//
+// `Drive::open(path)` → `wait_ready()` → `init()` → `Disc::scan()`. `Drive`
+// owns the SCSI session; `DriveCapture` etc. let advanced callers introspect
+// drive identity / profile data for sharing.
 pub use drive::capture::{
-    capture_drive_data, mask_bytes, mask_string, CapturedFeature, DriveCapture,
+    CapturedFeature, DriveCapture, capture_drive_data, mask_bytes, mask_string,
 };
-pub use drive::{find_drive, find_drives, Drive, DriveStatus};
+pub use drive::{Drive, DriveStatus, find_drive, find_drives};
+
+// ─── Errors ─────────────────────────────────────────────────────────────────
+//
+// All fallible APIs return `Result<T, Error>`. `Error` is a typed enum with a
+// numeric `code()`; **no English text in the library** — applications map
+// codes to localized messages. See `error.rs` for the full taxonomy.
 pub use error::{Error, Result};
+
+// ─── Drive events (low-level callbacks) ─────────────────────────────────────
 pub use event::{Event, EventKind};
 pub use identity::DriveId;
 pub use profile::DriveProfile;
-// Platform trait is pub(crate) -- callers use Drive, not Platform directly
-pub use decrypt::{decrypt_sectors, DecryptKeys};
+// Platform trait is pub(crate) — callers use Drive, not Platform directly.
+
+// ─── Decryption (AACS / CSS) ────────────────────────────────────────────────
+//
+// `Disc::scan()` resolves keys and stores them on `Disc`; in most flows you
+// don't touch `DecryptKeys` directly — `DiscStream::new(reader, title, keys, …)`
+// accepts whatever `Disc::decrypt_keys()` returned. `decrypt_sectors()` is
+// for callers that operate on raw sector buffers (e.g. ISO patching).
+pub use decrypt::{DecryptKeys, decrypt_sectors};
+
+// ─── Disc structure ─────────────────────────────────────────────────────────
+//
+// `Disc::scan()` produces a fully-populated `Disc` (titles, streams, AACS
+// state). `Disc::identify()` is the fast path — UDF only, no playlist parse,
+// for displaying disc name + format quickly while a full scan runs in the
+// background. The codec / channel / resolution enums are the canonical
+// structured representation; never compare against display strings.
 pub use disc::{
     AacsState, AudioChannels, AudioStream, Clip, Codec, ColorSpace, ContentFormat, Disc,
-    DiscFormat, DiscTitle, Extent, FrameRate, HdrFormat, KeySource, Resolution, SampleRate,
-    ScanOptions, Stream, SubtitleStream, VideoStream,
+    DiscFormat, DiscId, DiscTitle, Extent, FrameRate, HdrFormat, KeySource, LabelPurpose,
+    LabelQualifier, Resolution, SampleRate, ScanOptions, Stream, SubtitleStream, VideoStream,
 };
+
+// ─── Streams ────────────────────────────────────────────────────────────────
+//
+// All stream types implement `pes::Stream` — read PES frames from a source,
+// write PES frames to a sink. Pick the right type at construction:
+//
+// - `DiscStream` — physical drive or ISO (any `SectorReader`). Always read.
+// - `MkvStream`  — Matroska container. Read on `open()`, write on `create()`.
+// - `M2tsStream` — Blu-ray Transport Stream. Read on `open()`, write on `create()`.
+// - `NetworkStream` — TCP. Read on `listen()`, write on `connect()`.
+// - `NullStream` — write-only black-hole sink. Useful for benchmarks.
+// - `StdioStream` — pipe to/from stdin/stdout. Read or write.
+//
+// Most consumers use the URL resolvers (`input()` / `output()`) which pick
+// the right type from a scheme:// URL. Direct construction is for callers
+// that need to wire custom readers (e.g. autorip's drive-session reuse).
 pub use mux::DiscStream;
 pub use mux::M2tsStream;
 pub use mux::MkvStream;
 pub use mux::NetworkStream;
 pub use mux::NullStream;
 pub use mux::StdioStream;
-pub use mux::{input, output, parse_url, InputOptions, StreamUrl};
-pub use scsi::ScsiTransport;
-pub use sector::SectorReader;
+pub use mux::{InputOptions, StreamUrl, input, output, parse_url};
+
+// ─── Lower-level surfaces ───────────────────────────────────────────────────
+//
+// `ScsiTransport` is the platform-abstraction trait Drive uses; expose for
+// out-of-tree platform backends. `SectorReader` lets callers feed any byte
+// source (test harness, network image, SMB share) into the disc scan
+// pipeline; `FileSectorReader` is the standard ISO-on-disk implementation.
+pub use scsi::{DriveInfo, ScsiTransport, drive_has_disc, list_drives};
+pub use sector::{FileSectorReader, SectorReader};
 pub use speed::DriveSpeed;
-pub use udf::{read_filesystem, UdfFs};
+pub use udf::{UdfFs, read_filesystem};

src/mpls.rs

@@ -256,7 +256,7 @@ pub fn parse(data: &[u8]) -> Result<Playlist> {
 
     // Parse PlayListMark section
     let mut marks = Vec::new();
-    if mark_start > 0 && mark_start + 4 < data.len() {
+    if mark_start > 0 && mark_start + 4 <= data.len() {
         let ms = &data[mark_start..];
         if ms.len() >= 6 {
             let num_marks = u16::from_be_bytes([ms[4], ms[5]]) as usize;

src/mux/codec/ac3.rs

@@ -1,15 +1,15 @@
 //! AC3 (Dolby Digital) / EAC3 (Dolby Digital Plus) frame parser.
 //!
 //! AC3 frames are self-contained and always start with syncword 0x0B77.
-//! Each PES packet typically contains exactly one AC3 frame.
-//! All AC3 frames are effectively keyframes (no inter-frame dependencies).
-//!
-//! E-AC-3 shares the same syncword but uses bsid >= 11 (typically 16).
-//! Frame size is derived from the frmsiz field instead of fscod/frmsizecod.
+//! Buffers across PES boundaries so frames that span two PES packets
+//! are emitted complete, not truncated.
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
-pub struct Ac3Parser;
+pub struct Ac3Parser {
+    /// Leftover bytes from previous PES (incomplete frame at end).
+    buf: Vec<u8>,
+}
 
 impl Default for Ac3Parser {
     fn default() -> Self {
@@ -19,19 +19,24 @@ impl Default for Ac3Parser {
 
 impl Ac3Parser {
     pub fn new() -> Self {
-        Self
+        Self {
+            buf: Vec::with_capacity(4096),
+        }
     }
 }
 
 impl CodecParser for Ac3Parser {
     fn parse(&mut self, pes: &PesPacket) -> Vec<Frame> {
-        if pes.data.len() < 2 {
+        if pes.data.is_empty() {
             return Vec::new();
         }
 
         let pts_ns = pes.pts.map(pts_to_ns).unwrap_or(0);
 
-        let data = &pes.data;
+        // Prepend leftover from previous PES
+        self.buf.extend_from_slice(&pes.data);
+
+        let data = &self.buf;
         let mut frames = Vec::new();
         let mut pos = 0;
 
@@ -44,44 +49,54 @@ impl CodecParser for Ac3Parser {
 
             let remaining = &data[start..];
 
-            // Need at least 6 bytes to inspect bsid / frame size fields
             if remaining.len() < 6 {
-                // Emit whatever remains as a single frame
-                frames.push(Frame {
-                    pts_ns,
-                    keyframe: true,
-                    data: remaining.to_vec(),
-                });
+                // Not enough data to determine frame size — keep for next PES
                 break;
             }
 
             let bsid = get_bsid(remaining);
-
-            if bsid >= 11 {
-                // E-AC-3 frame size from frmsiz field (bytes 2-3)
-                let frame_size = eac3_frame_size(remaining);
-
-                let end = start + frame_size.min(data.len() - start);
-                frames.push(Frame {
-                    pts_ns,
-                    keyframe: true,
-                    data: data[start..end].to_vec(),
-                });
-                pos = end;
+            let frame_size = if bsid >= 11 {
+                eac3_frame_size(remaining)
             } else {
-                // AC-3: emit everything from syncword to next syncword (or end)
-                let next_sync = find_ac3_sync(&data[start + 2..]).map(|o| start + 2 + o);
-                let end = next_sync.unwrap_or(data.len());
-                frames.push(Frame {
-                    pts_ns,
-                    keyframe: true,
-                    data: data[start..end].to_vec(),
-                });
-                pos = end;
+                ac3_frame_size(remaining)
+            };
+
+            if frame_size == 0 || frame_size > 8192 {
+                // Invalid frame size — skip this sync word
+                pos = start + 2;
+                continue;
             }
+
+            if start + frame_size > data.len() {
+                // Incomplete frame — keep for next PES
+                break;
+            }
+
+            frames.push(Frame {
+                pts_ns,
+                keyframe: true,
+                data: data[start..start + frame_size].to_vec(),
+            });
+            pos = start + frame_size;
+        }
+
+        // Keep unconsumed data for next call
+        // `pos` points to the start of unconsumed data (either a partial sync or leftover)
+        let keep_from = if pos < data.len() {
+            // Find the last sync word position in the unconsumed region
+            find_ac3_sync(&data[pos..])
+                .map(|o| pos + o)
+                .unwrap_or(data.len())
+        } else {
+            data.len()
+        };
+
+        if keep_from < data.len() {
+            self.buf = data[keep_from..].to_vec();
+        } else {
+            self.buf.clear();
         }
 
-        // If we found no syncword at all, return empty — the data is not valid AC3.
         frames
     }
 
@@ -97,7 +112,6 @@ fn find_ac3_sync(data: &[u8]) -> Option<usize> {
 
 /// Extract bsid from an AC-3/E-AC-3 frame starting at the syncword.
 /// bsid is at byte 5, bits 7..3.
-/// AC-3: bsid <= 10, E-AC-3: bsid >= 11 (typically 16).
 pub fn get_bsid(data: &[u8]) -> u8 {
     if data.len() < 6 {
         return 0;
@@ -106,258 +120,166 @@ pub fn get_bsid(data: &[u8]) -> u8 {
 }
 
 /// Calculate E-AC-3 frame size in bytes from the frmsiz field.
-/// frmsiz is at bits [2:0] of byte 2 concatenated with byte 3.
-/// Frame size = (frmsiz + 1) * 2 bytes.
-pub fn eac3_frame_size(data: &[u8]) -> usize {
+fn eac3_frame_size(data: &[u8]) -> usize {
     if data.len() < 4 {
         return 0;
     }
-    let frmsiz = ((data[2] as usize & 0x07) << 8) | (data[3] as usize);
+    let frmsiz = ((data[2] as usize & 0x07) << 8) | data[3] as usize;
     (frmsiz + 1) * 2
 }
 
+/// Calculate AC-3 frame size in bytes from fscod and frmsizecod.
+fn ac3_frame_size(data: &[u8]) -> usize {
+    if data.len() < 5 {
+        return 0;
+    }
+    let fscod = (data[4] >> 6) & 0x03;
+    let frmsizecod = (data[4] & 0x3F) as usize;
+    if frmsizecod >= AC3_FRAME_SIZES.len() {
+        return 0;
+    }
+    let words = AC3_FRAME_SIZES[frmsizecod];
+    match fscod {
+        0 => words[0] * 2,
+        1 => words[1] * 2,
+        2 => words[2] * 2,
+        _ => 0,
+    }
+}
+
+/// AC-3 frame size table: [frmsizecod] -> [48kHz words, 44.1kHz words, 32kHz words]
+const AC3_FRAME_SIZES: [[usize; 3]; 38] = [
+    [64, 69, 96],
+    [64, 70, 96],
+    [80, 87, 120],
+    [80, 88, 120],
+    [96, 104, 144],
+    [96, 105, 144],
+    [112, 121, 168],
+    [112, 122, 168],
+    [128, 139, 192],
+    [128, 140, 192],
+    [160, 174, 240],
+    [160, 175, 240],
+    [192, 208, 288],
+    [192, 209, 288],
+    [224, 243, 336],
+    [224, 244, 336],
+    [256, 278, 384],
+    [256, 279, 384],
+    [320, 348, 480],
+    [320, 349, 480],
+    [384, 417, 576],
+    [384, 418, 576],
+    [448, 487, 672],
+    [448, 488, 672],
+    [512, 557, 768],
+    [512, 558, 768],
+    [640, 696, 960],
+    [640, 697, 960],
+    [768, 835, 1152],
+    [768, 836, 1152],
+    [896, 975, 1344],
+    [896, 976, 1344],
+    [1024, 1114, 1536],
+    [1024, 1115, 1536],
+    [1152, 1253, 1728],
+    [1152, 1254, 1728],
+    [1280, 1393, 1920],
+    [1280, 1394, 1920],
+];
+
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::mux::ts::PesPacket;
 
-    fn make_pes(data: Vec<u8>, pts: Option<i64>) -> PesPacket {
-        PesPacket {
-            pid: 0x1100,
-            pts,
-            dts: None,
-            data,
-        }
+    fn make_ac3_frame(fscod: u8, frmsizecod: u8) -> Vec<u8> {
+        let size = AC3_FRAME_SIZES[frmsizecod as usize][fscod as usize] * 2;
+        let mut frame = vec![0u8; size];
+        frame[0] = 0x0B;
+        frame[1] = 0x77;
+        frame[4] = (fscod << 6) | frmsizecod;
+        frame[5] = 0x08 << 3; // bsid = 8 (AC-3)
+        frame
     }
 
-    /// Build a minimal AC-3 header (bsid <= 10).
-    fn make_ac3_header(bsid: u8) -> Vec<u8> {
-        // 0x0B 0x77 <byte2> <byte3> <byte4> <byte5=bsid>
-        let byte5 = (bsid & 0x1F) << 3;
-        vec![0x0B, 0x77, 0x00, 0x00, 0x00, byte5, 0xAA, 0xBB]
-    }
-
-    /// Build a minimal E-AC-3 header with the given bsid and frmsiz.
-    /// frmsiz encodes frame size: frame_bytes = (frmsiz + 1) * 2.
-    fn make_eac3_header(bsid: u8, frmsiz: u16, payload_fill: u8) -> Vec<u8> {
-        let byte2 = (frmsiz >> 8) as u8 & 0x07;
-        let byte3 = (frmsiz & 0xFF) as u8;
-        let byte5 = (bsid & 0x1F) << 3;
-        let frame_size = (frmsiz as usize + 1) * 2;
-        let mut data = vec![0x0B, 0x77, byte2, byte3, 0x00, byte5];
-        // Pad to full frame size
-        while data.len() < frame_size {
-            data.push(payload_fill);
-        }
-        data.truncate(frame_size);
-        data
-    }
-
-    // --- syncword detection ---
-
-    #[test]
-    fn find_ac3_sync_at_start() {
-        let data = [0x0B, 0x77, 0x01, 0x02, 0x03];
-        assert_eq!(find_ac3_sync(&data), Some(0));
-    }
-
-    #[test]
-    fn find_ac3_sync_with_garbage_prefix() {
-        let data = [0xFF, 0xFE, 0x0B, 0x77, 0x01, 0x02];
-        assert_eq!(find_ac3_sync(&data), Some(2));
-    }
-
-    #[test]
-    fn find_ac3_sync_none() {
-        let data = [0x0B, 0x78, 0x00, 0x00];
-        assert_eq!(find_ac3_sync(&data), None);
-    }
-
-    #[test]
-    fn find_ac3_sync_empty() {
-        let data: [u8; 0] = [];
-        assert_eq!(find_ac3_sync(&data), None);
-    }
-
-    // --- bsid detection ---
-
-    #[test]
-    fn bsid_ac3() {
-        let header = make_ac3_header(8);
-        assert_eq!(get_bsid(&header), 8);
-    }
-
-    #[test]
-    fn bsid_eac3() {
-        let header = make_eac3_header(16, 99, 0x00);
-        assert_eq!(get_bsid(&header), 16);
-    }
-
-    #[test]
-    fn bsid_boundary_10() {
-        let header = make_ac3_header(10);
-        assert_eq!(get_bsid(&header), 10);
-        // bsid 10 should be treated as AC-3 (<= 10)
-        assert!(get_bsid(&header) <= 10);
-    }
-
-    #[test]
-    fn bsid_boundary_11() {
-        let header = make_eac3_header(11, 3, 0x00);
-        assert_eq!(get_bsid(&header), 11);
-        // bsid 11 should be treated as E-AC-3 (>= 11)
-        assert!(get_bsid(&header) >= 11);
-    }
-
-    // --- E-AC-3 frame size calculation ---
-
-    #[test]
-    fn eac3_frame_size_basic() {
-        // frmsiz = 99 → frame_size = (99+1)*2 = 200 bytes
-        let header = make_eac3_header(16, 99, 0xDD);
-        assert_eq!(eac3_frame_size(&header), 200);
-    }
-
-    #[test]
-    fn eac3_frame_size_min() {
-        // frmsiz = 0 → frame_size = (0+1)*2 = 2 bytes
-        let data = [0x0B, 0x77, 0x00, 0x00, 0x00, 0x80];
-        assert_eq!(eac3_frame_size(&data), 2);
-    }
-
-    #[test]
-    fn eac3_frame_size_large() {
-        // frmsiz = 0x7FF (max 11-bit) → (2047+1)*2 = 4096
-        let data = [0x0B, 0x77, 0x07, 0xFF, 0x00, 0x80];
-        assert_eq!(eac3_frame_size(&data), 4096);
-    }
-
-    // --- parse: E-AC-3 frame extraction ---
-
-    #[test]
-    fn parse_eac3_single_frame() {
-        let mut parser = Ac3Parser::new();
-        // frmsiz = 9 → frame_size = 20 bytes
-        let data = make_eac3_header(16, 9, 0xCC);
-        assert_eq!(data.len(), 20);
-        let pes = make_pes(data.clone(), Some(90000));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data.len(), 20);
-        assert_eq!(frames[0].pts_ns, 1_000_000_000);
-        assert!(frames[0].keyframe);
-    }
-
-    #[test]
-    fn parse_eac3_frame_with_garbage_prefix() {
-        let mut parser = Ac3Parser::new();
-        let mut data = vec![0xFF, 0xFE]; // garbage
-        data.extend_from_slice(&make_eac3_header(16, 4, 0xAA)); // frmsiz=4 → 10 bytes
-        let pes = make_pes(data, Some(0));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data[0], 0x0B);
-        assert_eq!(frames[0].data[1], 0x77);
-        assert_eq!(frames[0].data.len(), 10);
-    }
-
-    // --- parse syncword → frame extracted (AC-3) ---
-
-    #[test]
-    fn parse_syncword() {
-        let mut parser = Ac3Parser::new();
-
-        // AC3 frame starting with syncword (bsid=8)
-        let data = make_ac3_header(8);
-        let pes = make_pes(data.clone(), Some(90000));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data, data);
-        assert_eq!(frames[0].pts_ns, 1_000_000_000);
-    }
-
-    #[test]
-    fn parse_syncword_with_garbage_prefix() {
-        let mut parser = Ac3Parser::new();
-
-        // Garbage bytes before syncword
-        let mut data = vec![0xFF, 0xFE];
-        data.extend_from_slice(&make_ac3_header(8));
-        let pes = make_pes(data, Some(0));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data[0], 0x0B);
-        assert_eq!(frames[0].data[1], 0x77);
-    }
-
-    // --- all frames are keyframes ---
-
-    #[test]
-    fn all_keyframes() {
-        let mut parser = Ac3Parser::new();
-
-        for i in 0..5u8 {
-            let mut data = make_ac3_header(8);
-            data.push(i);
-            let pes = make_pes(data, Some(90000 * i as i64));
-            let frames = parser.parse(&pes);
-            assert_eq!(frames.len(), 1);
-            assert!(frames[0].keyframe, "AC3 frame {} should be a keyframe", i);
-        }
-    }
-
-    // --- codec_private is None ---
-
-    #[test]
-    fn codec_private_none() {
-        let parser = Ac3Parser::new();
-        assert!(parser.codec_private().is_none());
-    }
-
-    // --- empty / too-short PES ---
-
     #[test]
     fn parse_empty_pes() {
         let mut parser = Ac3Parser::new();
-        let pes = make_pes(Vec::new(), Some(0));
-        let frames = parser.parse(&pes);
-        assert!(frames.is_empty());
+        let pes = PesPacket {
+            pid: 0,
+            pts: None,
+            dts: None,
+            data: vec![],
+        };
+        assert!(parser.parse(&pes).is_empty());
     }
 
     #[test]
-    fn parse_single_byte_pes() {
+    fn parse_single_frame() {
         let mut parser = Ac3Parser::new();
-        let pes = make_pes(vec![0x0B], Some(0));
-        let frames = parser.parse(&pes);
-        assert!(frames.is_empty());
-    }
-
-    // --- PTS conversion ---
-
-    #[test]
-    fn pts_conversion() {
-        let mut parser = Ac3Parser::new();
-        let data = make_ac3_header(8);
-        // 45000 ticks = 0.5 seconds → 500_000_000 ns
-        let pes = make_pes(data, Some(45000));
+        let frame_data = make_ac3_frame(0, 2); // 48kHz, 80 words = 160 bytes
+        let pes = PesPacket {
+            pid: 0,
+            pts: Some(90000),
+            dts: None,
+            data: frame_data.clone(),
+        };
         let frames = parser.parse(&pes);
         assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].pts_ns, 500_000_000);
+        assert_eq!(frames[0].data.len(), 160);
     }
 
-    // --- None PTS ---
+    #[test]
+    fn parse_frame_spanning_two_pes() {
+        let mut parser = Ac3Parser::new();
+        let frame_data = make_ac3_frame(0, 2); // 160 bytes
+        let mid = 80;
+
+        // First PES: first half of frame
+        let pes1 = PesPacket {
+            pid: 0,
+            pts: Some(90000),
+            dts: None,
+            data: frame_data[..mid].to_vec(),
+        };
+        let frames1 = parser.parse(&pes1);
+        assert!(frames1.is_empty(), "partial frame should not emit");
+
+        // Second PES: second half
+        let pes2 = PesPacket {
+            pid: 0,
+            pts: Some(93000),
+            dts: None,
+            data: frame_data[mid..].to_vec(),
+        };
+        let frames2 = parser.parse(&pes2);
+        assert_eq!(frames2.len(), 1);
+        assert_eq!(frames2[0].data.len(), 160);
+    }
 
     #[test]
-    fn no_pts() {
+    fn skip_garbage_before_sync() {
         let mut parser = Ac3Parser::new();
-        let data = make_ac3_header(8);
-        let pes = make_pes(data, None);
+        let frame_data = make_ac3_frame(0, 2);
+        let mut data = vec![0xDE, 0xAD, 0xBE, 0xEF]; // garbage
+        data.extend_from_slice(&frame_data);
+        let pes = PesPacket {
+            pid: 0,
+            pts: None,
+            dts: None,
+            data,
+        };
         let frames = parser.parse(&pes);
         assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].pts_ns, 0);
+        assert_eq!(frames[0].data.len(), 160);
+    }
+
+    #[test]
+    fn ac3_frame_size_table() {
+        // fscod=0 (48kHz), frmsizecod=0: 64 words = 128 bytes
+        assert_eq!(ac3_frame_size(&[0x0B, 0x77, 0, 0, 0x00, 0x40]), 128);
+        // fscod=0 (48kHz), frmsizecod=2: 80 words = 160 bytes
+        assert_eq!(ac3_frame_size(&[0x0B, 0x77, 0, 0, 0x02, 0x40]), 160);
     }
 }

src/mux/codec/dts.rs

@@ -2,16 +2,17 @@
 //!
 //! DTS core syncword: 0x7FFE8001 (32 bits).
 //! DTS-HD MA/HRA extension syncword: 0x64582025 (32 bits), appears after the core frame.
-//! The extension contains high-resolution audio data and is appended to the core frame.
-//! All frames are keyframes (no inter-frame dependencies).
-//! Each PES packet = one frame.
+//! Buffers across PES boundaries so frames spanning two PES packets
+//! are emitted complete.
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
-/// DTS-HD extension syncword bytes.
+const DTS_CORE_SYNC: [u8; 4] = [0x7F, 0xFE, 0x80, 0x01];
 const DTS_HD_EXT_SYNC: [u8; 4] = [0x64, 0x58, 0x20, 0x25];
 
-pub struct DtsParser;
+pub struct DtsParser {
+    buf: Vec<u8>,
+}
 
 impl Default for DtsParser {
     fn default() -> Self {
@@ -21,7 +22,9 @@ impl Default for DtsParser {
 
 impl DtsParser {
     pub fn new() -> Self {
-        Self
+        Self {
+            buf: Vec::with_capacity(32768),
+        }
     }
 }
 
@@ -32,31 +35,77 @@ impl CodecParser for DtsParser {
         }
         let pts_ns = pes.pts.map(pts_to_ns).unwrap_or(0);
 
-        let data = &pes.data;
+        self.buf.extend_from_slice(&pes.data);
 
-        // Look for a DTS-HD extension substream after the core.
-        // If found, include both core + extension in the output frame.
-        let frame_data = match find_dts_hd_ext_sync(data) {
-            Some(ext_offset) => {
-                let ext = &data[ext_offset..];
-                if ext.len() >= 9 {
-                    let ext_size = dts_hd_ext_frame_size(ext);
-                    let total_end = ext_offset + ext_size;
-                    let end = total_end.min(data.len());
-                    data[..end].to_vec()
-                } else {
-                    // Extension header too short to parse size; include all data.
-                    data.to_vec()
+        let data = &self.buf;
+        let mut frames = Vec::new();
+        let mut pos = 0;
+
+        while pos < data.len() {
+            // Find DTS core sync
+            let start = match find_sync(&data[pos..], &DTS_CORE_SYNC) {
+                Some(offset) => pos + offset,
+                None => break,
+            };
+
+            // Need at least 10 bytes for core header to get frame size
+            if start + 10 > data.len() {
+                break;
+            }
+
+            let core_size = dts_core_frame_size(&data[start..]);
+            if core_size == 0 || core_size > 32768 {
+                pos = start + 4;
+                continue;
+            }
+
+            if start + core_size > data.len() {
+                // Incomplete core frame
+                break;
+            }
+
+            // Check for DTS-HD extension after core
+            let mut total_size = core_size;
+            if start + core_size + 4 <= data.len() {
+                if let Some(0) = find_sync(
+                    &data[start + core_size..start + core_size + 4],
+                    &DTS_HD_EXT_SYNC,
+                ) {
+                    let ext = &data[start + core_size..];
+                    if ext.len() >= 9 {
+                        let ext_size = dts_hd_ext_frame_size(ext);
+                        if start + core_size + ext_size <= data.len() {
+                            total_size = core_size + ext_size;
+                        }
+                        // If ext incomplete, just emit core
+                    }
                 }
             }
-            None => data.to_vec(),
+
+            frames.push(Frame {
+                pts_ns,
+                keyframe: true,
+                data: data[start..start + total_size].to_vec(),
+            });
+            pos = start + total_size;
+        }
+
+        // Keep unconsumed data
+        let keep_from = if pos < data.len() {
+            find_sync(&data[pos..], &DTS_CORE_SYNC)
+                .map(|o| pos + o)
+                .unwrap_or(data.len())
+        } else {
+            data.len()
         };
 
-        vec![Frame {
-            pts_ns,
-            keyframe: true,
-            data: frame_data,
-        }]
+        if keep_from < data.len() {
+            self.buf = data[keep_from..].to_vec();
+        } else {
+            self.buf.clear();
+        }
+
+        frames
     }
 
     fn codec_private(&self) -> Option<Vec<u8>> {
@@ -64,23 +113,27 @@ impl CodecParser for DtsParser {
     }
 }
 
-/// Find the DTS-HD extension syncword (0x64582025) in data.
-/// Returns the byte offset of the sync, or None.
-pub fn find_dts_hd_ext_sync(data: &[u8]) -> Option<usize> {
+fn find_sync(data: &[u8], pattern: &[u8; 4]) -> Option<usize> {
     if data.len() < 4 {
         return None;
     }
-    (0..=data.len() - 4).find(|&i| {
-        data[i] == DTS_HD_EXT_SYNC[0]
-            && data[i + 1] == DTS_HD_EXT_SYNC[1]
-            && data[i + 2] == DTS_HD_EXT_SYNC[2]
-            && data[i + 3] == DTS_HD_EXT_SYNC[3]
-    })
+    (0..=data.len() - 4).find(|&i| data[i..i + 4] == *pattern)
 }
 
-/// Calculate DTS-HD extension frame size from the extension header.
-/// The size field is at bytes 6-8 of the extension:
-///   ((ext[6] & 0x1F) << 11) | (ext[7] << 3) | (ext[8] >> 5) + 1
+/// DTS core frame size from header bits.
+/// fsize is at bits 46-59 (14 bits) of the header: bytes 5-7.
+fn dts_core_frame_size(data: &[u8]) -> usize {
+    if data.len() < 10 {
+        return 0;
+    }
+    // fsize field: 14 bits starting at bit 46
+    // byte 5 bits 1-0, byte 6 all 8, byte 7 bits 7-4
+    let fsize =
+        ((data[5] as usize & 0x03) << 12) | ((data[6] as usize) << 4) | ((data[7] as usize) >> 4);
+    fsize + 1
+}
+
+/// DTS-HD extension frame size from extension header.
 pub fn dts_hd_ext_frame_size(ext: &[u8]) -> usize {
     if ext.len() < 9 {
         return 0;
@@ -90,6 +143,10 @@ pub fn dts_hd_ext_frame_size(ext: &[u8]) -> usize {
     raw + 1
 }
 
+pub fn find_dts_hd_ext_sync(data: &[u8]) -> Option<usize> {
+    find_sync(data, &DTS_HD_EXT_SYNC)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -104,164 +161,16 @@ mod tests {
         }
     }
 
-    /// Build a DTS core frame with given payload size.
-    fn make_dts_core(payload_len: usize) -> Vec<u8> {
-        let mut data = vec![0x7F, 0xFE, 0x80, 0x01];
-        data.resize(4 + payload_len, 0xAA);
+    fn make_dts_core(size: usize) -> Vec<u8> {
+        let fsize = size - 1;
+        let mut data = vec![0u8; size];
+        data[0..4].copy_from_slice(&DTS_CORE_SYNC);
+        data[5] = (data[5] & 0xFC) | ((fsize >> 12) & 0x03) as u8;
+        data[6] = ((fsize >> 4) & 0xFF) as u8;
+        data[7] = (data[7] & 0x0F) | (((fsize & 0x0F) << 4) as u8);
         data
     }
 
-    /// Build a DTS-HD extension header + payload.
-    /// ext_size is the value to encode (frame size = ext_size + 1 reported by dts_hd_ext_frame_size,
-    /// but we encode raw = ext_size so that dts_hd_ext_frame_size returns ext_size + 1).
-    fn make_dts_hd_ext(raw_size_field: usize, payload_fill: u8) -> Vec<u8> {
-        let total = raw_size_field + 1; // the size dts_hd_ext_frame_size will return
-        let byte6 = ((raw_size_field >> 11) & 0x1F) as u8;
-        let byte7 = ((raw_size_field >> 3) & 0xFF) as u8;
-        let byte8 = ((raw_size_field & 0x07) << 5) as u8;
-        let mut data = vec![0x64, 0x58, 0x20, 0x25, 0x00, 0x00, byte6, byte7, byte8];
-        while data.len() < total {
-            data.push(payload_fill);
-        }
-        data.truncate(total);
-        data
-    }
-
-    // --- DTS-HD extension sync detection ---
-
-    #[test]
-    fn find_ext_sync_at_offset() {
-        let mut data = vec![0x7F, 0xFE, 0x80, 0x01, 0x00, 0x00];
-        data.extend_from_slice(&[0x64, 0x58, 0x20, 0x25]);
-        assert_eq!(find_dts_hd_ext_sync(&data), Some(6));
-    }
-
-    #[test]
-    fn find_ext_sync_none() {
-        let data = vec![0x7F, 0xFE, 0x80, 0x01, 0x00, 0x00];
-        assert_eq!(find_dts_hd_ext_sync(&data), None);
-    }
-
-    #[test]
-    fn find_ext_sync_at_start() {
-        let data = vec![0x64, 0x58, 0x20, 0x25, 0x00];
-        assert_eq!(find_dts_hd_ext_sync(&data), Some(0));
-    }
-
-    #[test]
-    fn find_ext_sync_too_short() {
-        let data = vec![0x64, 0x58, 0x20];
-        assert_eq!(find_dts_hd_ext_sync(&data), None);
-    }
-
-    // --- DTS-HD extension frame size ---
-
-    #[test]
-    fn ext_frame_size_basic() {
-        // raw_size_field = 100 → frame size = 101
-        let ext = make_dts_hd_ext(100, 0xBB);
-        assert_eq!(dts_hd_ext_frame_size(&ext), 101);
-    }
-
-    #[test]
-    fn ext_frame_size_zero() {
-        // raw_size_field = 0 → frame size = 1
-        let ext = vec![0x64, 0x58, 0x20, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00];
-        assert_eq!(dts_hd_ext_frame_size(&ext), 1);
-    }
-
-    #[test]
-    fn ext_frame_size_large() {
-        // raw = 0x1F << 11 | 0xFF << 3 | 0x07 = 0xFFFF = 65535
-        // frame_size = 65536
-        let ext = vec![0x64, 0x58, 0x20, 0x25, 0x00, 0x00, 0x1F, 0xFF, 0xFF];
-        // byte6=0x1F, byte7=0xFF, byte8=0xFF
-        // (0x1F << 11) | (0xFF << 3) | (0xFF >> 5) = 63488 | 2040 | 7 = 65535
-        assert_eq!(dts_hd_ext_frame_size(&ext), 65536);
-    }
-
-    // --- parse: core + extension frame ---
-
-    #[test]
-    fn parse_core_plus_extension() {
-        let mut parser = DtsParser::new();
-        let core = make_dts_core(20); // 24 bytes total
-        let ext = make_dts_hd_ext(50, 0xCC); // 51 bytes
-        let mut data = core.clone();
-        data.extend_from_slice(&ext);
-
-        let pes = make_pes(data.clone(), Some(90000));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        // Frame should include core (24) + extension (51) = 75 bytes
-        assert_eq!(frames[0].data.len(), 24 + 51);
-        assert_eq!(frames[0].pts_ns, 1_000_000_000);
-        assert!(frames[0].keyframe);
-    }
-
-    #[test]
-    fn parse_core_only() {
-        let mut parser = DtsParser::new();
-        let data = make_dts_core(10);
-        let pes = make_pes(data.clone(), Some(90000));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data, data);
-    }
-
-    #[test]
-    fn parse_core_plus_extension_truncated_at_buffer_end() {
-        let mut parser = DtsParser::new();
-        let core = make_dts_core(4); // 8 bytes
-                                     // Extension claims 200 bytes but we only provide 20
-        let ext = make_dts_hd_ext(199, 0xDD); // wants 200 bytes
-        let mut data = core;
-        // Only append partial extension (first 20 bytes)
-        data.extend_from_slice(&ext[..20.min(ext.len())]);
-
-        let total_len = data.len();
-        let pes = make_pes(data, Some(0));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        // Should be clamped to actual data length
-        assert_eq!(frames[0].data.len(), total_len);
-    }
-
-    // --- basic tests (carried over) ---
-
-    #[test]
-    fn parse_basic_frame() {
-        let mut parser = DtsParser::new();
-        let data = vec![0x7F, 0xFE, 0x80, 0x01, 0xAA, 0xBB, 0xCC];
-        let pes = make_pes(data.clone(), Some(90000));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data, data);
-        assert_eq!(frames[0].pts_ns, 1_000_000_000);
-    }
-
-    #[test]
-    fn all_keyframes() {
-        let mut parser = DtsParser::new();
-        for i in 0..3 {
-            let data = vec![0x7F, 0xFE, 0x80, 0x01, i];
-            let pes = make_pes(data, Some(90000 * i as i64));
-            let frames = parser.parse(&pes);
-            assert_eq!(frames.len(), 1);
-            assert!(frames[0].keyframe, "DTS frame should always be keyframe");
-        }
-    }
-
-    #[test]
-    fn codec_private_none() {
-        let parser = DtsParser::new();
-        assert!(parser.codec_private().is_none());
-    }
-
     #[test]
     fn parse_empty_pes() {
         let mut parser = DtsParser::new();
@@ -270,11 +179,33 @@ mod tests {
     }
 
     #[test]
-    fn no_pts() {
+    fn parse_single_frame() {
         let mut parser = DtsParser::new();
-        let pes = make_pes(vec![0x7F, 0xFE, 0x80, 0x01], None);
+        let frame = make_dts_core(512);
+        let pes = make_pes(frame, Some(90000));
         let frames = parser.parse(&pes);
         assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].pts_ns, 0);
+        assert_eq!(frames[0].data.len(), 512);
+    }
+
+    #[test]
+    fn parse_frame_spanning_two_pes() {
+        let mut parser = DtsParser::new();
+        let frame = make_dts_core(512);
+        let mid = 256;
+
+        let pes1 = make_pes(frame[..mid].to_vec(), Some(90000));
+        assert!(parser.parse(&pes1).is_empty());
+
+        let pes2 = make_pes(frame[mid..].to_vec(), Some(93000));
+        let frames = parser.parse(&pes2);
+        assert_eq!(frames.len(), 1);
+        assert_eq!(frames[0].data.len(), 512);
+    }
+
+    #[test]
+    fn codec_private_none() {
+        let parser = DtsParser::new();
+        assert!(parser.codec_private().is_none());
     }
 }

src/mux/codec/dvdsub.rs

@@ -7,26 +7,15 @@
 //! For MKV: codec ID "S_VOBSUB".
 //! All frames are keyframes (each is a complete bitmap).
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 pub struct DvdSubParser {
     /// Pre-formatted VobSub .idx palette header for codec_private.
     codec_data: Option<Vec<u8>>,
 }
 
-impl Default for DvdSubParser {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
 impl DvdSubParser {
-    pub fn new() -> Self {
-        Self { codec_data: None }
-    }
-
-    /// Create a parser with pre-formatted codec private data (palette header).
-    pub fn with_codec_data(codec_data: Option<Vec<u8>>) -> Self {
+    pub fn new(codec_data: Option<Vec<u8>>) -> Self {
         Self { codec_data }
     }
 }
@@ -109,7 +98,7 @@ mod tests {
 
     #[test]
     fn passthrough_data() {
-        let mut parser = DvdSubParser::new();
+        let mut parser = DvdSubParser::new(None);
         let sub_data = vec![0x00, 0x0A, 0x00, 0x08, 0x01, 0xFF, 0x02, 0x03, 0x04, 0x05];
         let pes = make_pes(sub_data.clone(), Some(90000));
         let frames = parser.parse(&pes);
@@ -124,7 +113,7 @@ mod tests {
 
     #[test]
     fn always_keyframe() {
-        let mut parser = DvdSubParser::new();
+        let mut parser = DvdSubParser::new(None);
         for i in 0..3u8 {
             let data = vec![0x00, i, 0x00, i + 1];
             let pes = make_pes(data, Some(90000 * i as i64));
@@ -139,21 +128,21 @@ mod tests {
 
     #[test]
     fn empty_pes_returns_no_frames() {
-        let mut parser = DvdSubParser::new();
+        let mut parser = DvdSubParser::new(None);
         let pes = make_pes(Vec::new(), Some(0));
         assert!(parser.parse(&pes).is_empty());
     }
 
     #[test]
     fn codec_private_none_by_default() {
-        let parser = DvdSubParser::new();
+        let parser = DvdSubParser::new(None);
         assert!(parser.codec_private().is_none());
     }
 
     #[test]
     fn codec_private_returns_palette_when_set() {
         let palette_data = b"palette: 000000, ffffff\n".to_vec();
-        let parser = DvdSubParser::with_codec_data(Some(palette_data.clone()));
+        let parser = DvdSubParser::new(Some(palette_data.clone()));
         let cp = parser.codec_private();
         assert!(cp.is_some());
         assert_eq!(cp.unwrap(), palette_data);
@@ -161,7 +150,7 @@ mod tests {
 
     #[test]
     fn no_pts_defaults_to_zero() {
-        let mut parser = DvdSubParser::new();
+        let mut parser = DvdSubParser::new(None);
         let pes = make_pes(vec![0x01, 0x02], None);
         let frames = parser.parse(&pes);
         assert_eq!(frames.len(), 1);

src/mux/codec/h264.rs

@@ -4,7 +4,7 @@
 //! Detects keyframes (IDR slices).
 //! Each PES packet = one access unit = one frame.
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 /// H.264 NAL unit types we care about.
 const NAL_SLICE_IDR: u8 = 5;
@@ -263,7 +263,7 @@ mod tests {
         data.extend_from_slice(&[0x00, 0x00, 0x01]);
         data.push(0x67); // SPS
         data.extend_from_slice(&[0x42, 0x00, 0x1E, 0xAB, 0xCD]); // profile=0x42, compat=0x00, level=0x1E
-                                                                 // PPS: 00 00 01 [68 <payload>]
+        // PPS: 00 00 01 [68 <payload>]
         data.extend_from_slice(&[0x00, 0x00, 0x01]);
         data.push(0x68); // PPS
         data.extend_from_slice(&[0xCE, 0x01]);

src/mux/codec/hevc.rs

@@ -5,7 +5,7 @@
 //! Each PES packet = one access unit = one frame.
 
 use super::h264::{find_start_code, skip_start_code};
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 // HEVC NAL unit types
 const NAL_VPS: u8 = 32;
@@ -122,7 +122,7 @@ impl CodecParser for HevcParser {
 
         // Minimal HEVCDecoderConfigurationRecord header
         record.push(1); // configurationVersion
-                        // General profile space, tier flag, profile IDC from SPS
+        // General profile space, tier flag, profile IDC from SPS
         if sps.len() > 3 {
             record.push(sps[1]); // general_profile_space + general_tier_flag + general_profile_idc
         } else {
@@ -154,7 +154,7 @@ impl CodecParser for HevcParser {
         record.push(0xFC);
         // chromaFormat (6 + 2 bits)
         record.push(0xFC | 1); // 4:2:0
-                               // bitDepthLumaMinus8 (5 + 3 bits)
+        // bitDepthLumaMinus8 (5 + 3 bits)
         record.push(0xF8);
         // bitDepthChromaMinus8 (5 + 3 bits)
         record.push(0xF8);
@@ -162,7 +162,7 @@ impl CodecParser for HevcParser {
         record.extend_from_slice(&[0, 0]);
         // constantFrameRate + numTemporalLayers + temporalIdNested + lengthSizeMinusOne
         record.push(0x03); // lengthSizeMinusOne = 3 (4 bytes)
-                           // numOfArrays
+        // numOfArrays
         record.push(3); // VPS, SPS, PPS
 
         // VPS array

src/mux/codec/lpcm.rs

@@ -13,7 +13,7 @@
 //! For MKV: codec ID "A_PCM/INT/BIG" (BD) or "A_PCM/INT/LIT" (DVD).
 //! All frames are keyframes (uncompressed audio).
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 /// BD LPCM header size in bytes.
 const BD_LPCM_HEADER_SIZE: usize = 4;

src/mux/codec/mod.rs

@@ -79,18 +79,10 @@ impl CodecParser for PassthroughParser {
     }
 }
 
-/// Create the appropriate parser for a codec.
-pub fn parser_for_codec(codec: Codec) -> Box<dyn CodecParser> {
-    parser_for_codec_with_data(codec, None)
-}
-
 /// Create the appropriate parser for a codec, with optional codec private data.
 ///
 /// For DvdSub, `codec_data` should be the pre-formatted VobSub .idx palette header.
-pub fn parser_for_codec_with_data(
-    codec: Codec,
-    codec_data: Option<Vec<u8>>,
-) -> Box<dyn CodecParser> {
+pub fn parser_for_codec(codec: Codec, codec_data: Option<Vec<u8>>) -> Box<dyn CodecParser> {
     match codec {
         Codec::H264 => Box::new(h264::H264Parser::new()),
         Codec::Hevc => Box::new(hevc::HevcParser::new()),
@@ -101,7 +93,7 @@ pub fn parser_for_codec_with_data(
         Codec::TrueHd => Box::new(truehd::TrueHdParser::new()),
         Codec::Pgs => Box::new(pgs::PgsParser::new()),
         Codec::Lpcm => Box::new(lpcm::LpcmParser::new()),
-        Codec::DvdSub => Box::new(dvdsub::DvdSubParser::with_codec_data(codec_data)),
+        Codec::DvdSub => Box::new(dvdsub::DvdSubParser::new(codec_data)),
         _ => Box::new(PassthroughParser::new(true)),
     }
 }

src/mux/codec/mpeg2.rs

@@ -9,7 +9,7 @@
 //! - Sequence extension: 00 00 01 B5
 //! - Picture header: 00 00 01 00
 
-use super::{pts_to_ns, CodecParser, Frame};
+use super::{CodecParser, Frame, pts_to_ns};
 use crate::mux::ts::PesPacket;
 
 /// Sequence header start code suffix.
@@ -62,7 +62,10 @@ impl Default for Mpeg2Parser {
 
 impl Mpeg2Parser {
     pub fn new() -> Self {
-        Self { seq_header: None, has_extension: false }
+        Self {
+            seq_header: None,
+            has_extension: false,
+        }
     }
 
     /// Extract resolution from a captured sequence header.
@@ -137,16 +140,20 @@ impl CodecParser for Mpeg2Parser {
                             } else {
                                 let mut bits = 63u32; // bits consumed so far
                                 let intra = (data[sc + 11] & 0x02) != 0;
-                                if intra { bits += 64 * 8; }
+                                if intra {
+                                    bits += 64 * 8;
+                                }
                                 // Non-intra flag is at current bit position
                                 let byte_pos = (bits / 8) as usize;
                                 let bit_pos = 7 - (bits % 8) as u8;
                                 if sc + 4 + byte_pos < data.len() {
                                     let non_intra = (data[sc + 4 + byte_pos] >> bit_pos) & 1 != 0;
                                     bits += 1;
-                                    if non_intra { bits += 64 * 8; }
+                                    if non_intra {
+                                        bits += 64 * 8;
+                                    }
                                 }
-                                let total_bytes = 4 + ((bits + 7) / 8) as usize;
+                                let total_bytes = 4 + bits.div_ceil(8) as usize;
                                 (sc + total_bytes).min(data.len())
                             }
                         }
@@ -408,7 +415,7 @@ mod tests {
         // Sequence extension: 00 00 01 B5 [ext data]
         data.extend_from_slice(&[0x00, 0x00, 0x01, SEQ_EXT_CODE]);
         data.extend_from_slice(&[0x14, 0x8A, 0x00, 0x01, 0x00, 0x00]); // ext payload
-                                                                       // Picture header follows.
+        // Picture header follows.
         data.extend_from_slice(&make_picture_header(PICTURE_TYPE_I));
         data.extend_from_slice(&[0xFF; 4]);
 

src/mux/codec/pgs.rs

@@ -4,7 +4,7 @@
 //! Each PES packet contains one or more segments.
 //! All segments are keyframes (no inter-segment dependencies).
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 pub struct PgsParser;
 

src/mux/codec/truehd.rs

@@ -1,14 +1,25 @@
 //! Dolby TrueHD / Atmos elementary stream parser.
 //!
-//! TrueHD major sync: 0xF8726FBA at a 4-byte aligned position.
-//! Access units consist of a major sync followed by minor syncs.
-//! An embedded AC3 core is in substream 0 for backward compatibility.
-//! All access units are keyframes.
-//! Each PES packet = one access unit.
+//! BD-TS TrueHD PES packets contain interleaved AC-3 + TrueHD access units.
+//! Access units span PES boundaries — must buffer and reassemble.
+//!
+//! TrueHD access unit header (4 bytes):
+//!   [0..1] upper 4 bits = parity, lower 12 bits = length in 2-byte words
+//!   [2..3] timing value
+//!   [4..]  substream data (major sync 0xF8726FBA may appear at offset 4)
+//!
+//! AC-3 frames (interleaved, same PID): start with sync word 0x0B77.
+//! We skip AC-3 frames and only emit TrueHD access units.
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
-pub struct TrueHdParser;
+/// Duration of one TrueHD access unit in nanoseconds (1/1200 second).
+const AU_DURATION_NS: i64 = 833_333;
+
+pub struct TrueHdParser {
+    buf: Vec<u8>,
+    next_pts_ns: i64,
+}
 
 impl Default for TrueHdParser {
     fn default() -> Self {
@@ -18,7 +29,58 @@ impl Default for TrueHdParser {
 
 impl TrueHdParser {
     pub fn new() -> Self {
-        Self
+        Self {
+            buf: Vec::with_capacity(32768),
+            next_pts_ns: 0,
+        }
+    }
+
+    /// Skip an AC-3 frame starting at the current buffer position.
+    /// Returns number of bytes consumed, or 0 if not enough data.
+    fn skip_ac3_frame(&self) -> usize {
+        if self.buf.len() < 6 {
+            return 0;
+        }
+        // AC-3 frame size from frmsizcod + fscod
+        // Byte 4: [fscod:2][frmsizecod:6]
+        let fscod = (self.buf[4] >> 6) & 0x03;
+        let frmsizecod = (self.buf[4] & 0x3F) as usize;
+        // Frame size in 16-bit words per fscod (simplified table for common rates)
+        let frame_words = match fscod {
+            0 => {
+                // 48 kHz
+                static SIZES: [usize; 38] = [
+                    64, 64, 80, 80, 96, 96, 112, 112, 128, 128, 160, 160, 192, 192, 224, 224, 256,
+                    256, 320, 320, 384, 384, 448, 448, 512, 512, 640, 640, 768, 768, 896, 896,
+                    1024, 1024, 1152, 1152, 1280, 1280,
+                ];
+                SIZES.get(frmsizecod).copied().unwrap_or(0)
+            }
+            1 => {
+                // 44.1 kHz
+                static SIZES: [usize; 38] = [
+                    69, 70, 87, 88, 104, 105, 121, 122, 139, 140, 174, 175, 208, 209, 243, 244,
+                    278, 279, 348, 349, 417, 418, 487, 488, 557, 558, 696, 697, 835, 836, 975, 976,
+                    1114, 1115, 1253, 1254, 1393, 1394,
+                ];
+                SIZES.get(frmsizecod).copied().unwrap_or(0)
+            }
+            2 => {
+                // 32 kHz
+                static SIZES: [usize; 38] = [
+                    96, 96, 120, 120, 144, 144, 168, 168, 192, 192, 240, 240, 288, 288, 336, 336,
+                    384, 384, 480, 480, 576, 576, 672, 672, 768, 768, 960, 960, 1152, 1152, 1344,
+                    1344, 1536, 1536, 1728, 1728, 1920, 1920,
+                ];
+                SIZES.get(frmsizecod).copied().unwrap_or(0)
+            }
+            _ => 0,
+        };
+        let frame_bytes = frame_words * 2;
+        if frame_bytes == 0 || self.buf.len() < frame_bytes {
+            return 0;
+        }
+        frame_bytes
     }
 }
 
@@ -27,12 +89,62 @@ impl CodecParser for TrueHdParser {
         if pes.data.is_empty() {
             return Vec::new();
         }
-        let pts_ns = pes.pts.map(pts_to_ns).unwrap_or(0);
-        vec![Frame {
-            pts_ns,
-            keyframe: true,
-            data: pes.data.clone(),
-        }]
+
+        if let Some(pts) = pes.pts {
+            self.next_pts_ns = pts_to_ns(pts);
+        }
+
+        self.buf.extend_from_slice(&pes.data);
+
+        let mut frames = Vec::new();
+
+        loop {
+            if self.buf.len() < 4 {
+                break;
+            }
+
+            // AC-3 frame (interleaved): starts with sync word 0x0B77
+            if self.buf[0] == 0x0B && self.buf[1] == 0x77 {
+                let skip = self.skip_ac3_frame();
+                if skip == 0 {
+                    break; // incomplete AC-3 frame, wait for more data
+                }
+                self.buf.drain(..skip);
+                continue;
+            }
+
+            // TrueHD access unit: lower 12 bits of first 2 bytes = length in words
+            let unit_words = (((self.buf[0] as usize) << 8) | self.buf[1] as usize) & 0xFFF;
+            if unit_words == 0 {
+                self.buf.drain(..2);
+                continue;
+            }
+            let unit_bytes = unit_words * 2;
+            if unit_bytes > 32768 {
+                // Likely misaligned — try to resync by scanning for AC-3 sync or
+                // a valid TrueHD length
+                self.buf.drain(..2);
+                continue;
+            }
+            if self.buf.len() < unit_bytes {
+                break; // incomplete access unit, wait for more data
+            }
+
+            let is_major_sync = unit_bytes >= 8
+                && (u32::from_be_bytes([self.buf[4], self.buf[5], self.buf[6], self.buf[7]])
+                    & 0xFFFF_FFFE)
+                    == 0xF872_6FBA;
+
+            frames.push(Frame {
+                pts_ns: self.next_pts_ns,
+                keyframe: is_major_sync,
+                data: self.buf[..unit_bytes].to_vec(),
+            });
+            self.buf.drain(..unit_bytes);
+            self.next_pts_ns += AU_DURATION_NS;
+        }
+
+        frames
     }
 
     fn codec_private(&self) -> Option<Vec<u8>> {
@@ -54,35 +166,21 @@ mod tests {
         }
     }
 
-    #[test]
-    fn parse_basic_frame() {
-        let mut parser = TrueHdParser::new();
-        // TrueHD major sync: F8 72 6F BA (at 4-byte aligned position) + payload
-        let data = vec![0xF8, 0x72, 0x6F, 0xBA, 0x01, 0x02, 0x03, 0x04];
-        let pes = make_pes(data.clone(), Some(90000));
-        let frames = parser.parse(&pes);
-
-        assert_eq!(frames.len(), 1);
-        assert_eq!(frames[0].data, data);
-        assert_eq!(frames[0].pts_ns, 1_000_000_000);
+    fn make_truehd_unit(size_bytes: usize) -> Vec<u8> {
+        let words = size_bytes / 2;
+        let mut data = vec![0u8; size_bytes];
+        data[0] = ((words >> 8) & 0x0F) as u8;
+        data[1] = (words & 0xFF) as u8;
+        data
     }
 
-    #[test]
-    fn all_keyframes() {
-        let mut parser = TrueHdParser::new();
-        for i in 0..3 {
-            let data = vec![0xF8, 0x72, 0x6F, 0xBA, i];
-            let pes = make_pes(data, Some(90000 * i as i64));
-            let frames = parser.parse(&pes);
-            assert_eq!(frames.len(), 1);
-            assert!(frames[0].keyframe, "TrueHD frame should always be keyframe");
-        }
-    }
-
-    #[test]
-    fn codec_private_none() {
-        let parser = TrueHdParser::new();
-        assert!(parser.codec_private().is_none());
+    fn make_ac3_frame() -> Vec<u8> {
+        // Minimal AC-3 frame: sync 0x0B77, fscod=0 (48kHz), frmsizecod=0 (64 words = 128 bytes)
+        let mut data = vec![0u8; 128];
+        data[0] = 0x0B;
+        data[1] = 0x77;
+        data[4] = 0x00; // fscod=0, frmsizecod=0
+        data
     }
 
     #[test]
@@ -91,4 +189,61 @@ mod tests {
         let pes = make_pes(Vec::new(), Some(0));
         assert!(parser.parse(&pes).is_empty());
     }
+
+    #[test]
+    fn parse_single_unit() {
+        let mut parser = TrueHdParser::new();
+        let unit = make_truehd_unit(200);
+        let pes = make_pes(unit, Some(90000));
+        let frames = parser.parse(&pes);
+        assert_eq!(frames.len(), 1);
+        assert_eq!(frames[0].data.len(), 200);
+    }
+
+    #[test]
+    fn parse_unit_spanning_two_pes() {
+        let mut parser = TrueHdParser::new();
+        let unit = make_truehd_unit(200);
+        let mid = 100;
+
+        let pes1 = make_pes(unit[..mid].to_vec(), Some(90000));
+        assert!(parser.parse(&pes1).is_empty());
+
+        let pes2 = make_pes(unit[mid..].to_vec(), Some(93000));
+        let frames = parser.parse(&pes2);
+        assert_eq!(frames.len(), 1);
+        assert_eq!(frames[0].data.len(), 200);
+    }
+
+    #[test]
+    fn parse_multiple_units_incrementing_pts() {
+        let mut parser = TrueHdParser::new();
+        let mut data = make_truehd_unit(100);
+        data.extend_from_slice(&make_truehd_unit(120));
+        let pes = make_pes(data, Some(90000));
+        let frames = parser.parse(&pes);
+        assert_eq!(frames.len(), 2);
+        assert_eq!(frames[0].data.len(), 100);
+        assert_eq!(frames[1].data.len(), 120);
+        assert_eq!(frames[1].pts_ns - frames[0].pts_ns, AU_DURATION_NS);
+    }
+
+    #[test]
+    fn skip_interleaved_ac3() {
+        let mut parser = TrueHdParser::new();
+        let ac3 = make_ac3_frame();
+        let truehd = make_truehd_unit(200);
+        let mut data = ac3;
+        data.extend_from_slice(&truehd);
+        let pes = make_pes(data, Some(90000));
+        let frames = parser.parse(&pes);
+        assert_eq!(frames.len(), 1);
+        assert_eq!(frames[0].data.len(), 200);
+    }
+
+    #[test]
+    fn codec_private_none() {
+        let parser = TrueHdParser::new();
+        assert!(parser.codec_private().is_none());
+    }
 }

src/mux/codec/vc1.rs

@@ -5,7 +5,7 @@
 //! Frame start = Frame header start code (0x0D).
 //! I-frames (keyframes) are identified from the frame header.
 
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};
 
 const SC_SEQUENCE_HEADER: u8 = 0x0F;
 const SC_ENTRY_POINT: u8 = 0x0E;

src/mux/disc.rs

@@ -5,9 +5,93 @@
 //!
 //! Read-only. For disc→ISO (raw sector copy), use `Disc::copy()`.
 
-use crate::disc::{detect_max_batch_sectors, Disc, DiscTitle, Extent, ScanOptions};
+use crate::disc::{Disc, DiscTitle, Extent};
+use crate::event::{BatchSizeReason, Event, EventKind};
 use crate::sector::SectorReader;
 use std::io;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+/// Ramp back up to the preferred batch size after this many sectors
+/// of clean reading at the current (reduced) size. 100 MiB = 51,200 sectors.
+///
+/// Chosen so that an isolated transient failure doesn't lock the rip at
+/// size 1: once past the bad zone, we probe up after ~100 ms of good reads.
+/// And so that noisy zones with occasional successes can't trigger a
+/// premature probe — we need a sustained clean run.
+const PROBE_THRESHOLD_SECTORS: u32 = 100 * 1024 * 1024 / 2048;
+
+/// Halve a batch size, keeping 3-sector alignment when >= 6
+/// (3-sector alignment = one AACS unit). At sizes < 6 we descend
+/// through 3 → 1 without intermediate unaligned sizes.
+fn halve_batch_size(size: u16) -> u16 {
+    let h = (size / 2).max(1);
+    if h >= 6 { h - (h % 3) } else { h }
+}
+
+/// Double a batch size toward a preferred max, keeping 3-sector alignment
+/// when the result is >= 6.
+fn double_batch_size(size: u16, preferred: u16) -> u16 {
+    let d = size.saturating_mul(2).min(preferred);
+    if d >= 6 { d - (d % 3) } else { d }
+}
+
+/// Adaptive batch sizer. Shrinks on read failure, grows after a sustained
+/// clean streak. Amortizes the cost of entering a bad zone — descent happens
+/// once, not once per bad sector.
+#[derive(Debug)]
+struct AdaptiveBatch {
+    preferred: u16,
+    current: u16,
+    streak_sectors: u32,
+}
+
+impl AdaptiveBatch {
+    fn new(preferred: u16) -> Self {
+        Self {
+            preferred,
+            current: preferred,
+            streak_sectors: 0,
+        }
+    }
+
+    fn current(&self) -> u16 {
+        self.current
+    }
+
+    /// Record a successful read of `sectors`. Returns an event if the
+    /// sizer probed up to a larger batch size.
+    fn on_success(&mut self, sectors: u16) -> Option<EventKind> {
+        self.streak_sectors = self.streak_sectors.saturating_add(sectors as u32);
+        if self.current < self.preferred && self.streak_sectors >= PROBE_THRESHOLD_SECTORS {
+            let new_size = double_batch_size(self.current, self.preferred);
+            if new_size != self.current {
+                self.current = new_size;
+                self.streak_sectors = 0;
+                return Some(EventKind::BatchSizeChanged {
+                    new_size,
+                    reason: BatchSizeReason::Probed,
+                });
+            }
+        }
+        None
+    }
+
+    /// Record a read failure. Returns an event if the sizer shrank.
+    /// Does nothing at size 1 (caller handles skip/error).
+    fn on_failure(&mut self) -> Option<EventKind> {
+        self.streak_sectors = 0;
+        if self.current <= 1 {
+            return None;
+        }
+        let new_size = halve_batch_size(self.current);
+        self.current = new_size;
+        Some(EventKind::BatchSizeChanged {
+            new_size,
+            reason: BatchSizeReason::Shrunk,
+        })
+    }
+}
 
 /// Disc stream. Reads sectors from any source → PES frames.
 ///
@@ -30,11 +114,27 @@ pub struct DiscStream {
     read_buf: Vec<u8>,
     buf_valid: usize,
 
-    // Batch size for reads
-    batch_sectors: u16,
+    // Adaptive batch sizer — preferred comes from the caller
+    // (detect_max_batch_sectors), shrinks/grows based on read outcomes.
+    adaptive: AdaptiveBatch,
     pub errors: u64,
+    pub skip_errors: bool,
+    /// When set and the flag is raised, fill_extents returns Err(Halted) at the
+    /// next retry boundary. Unlike skip_errors, this propagates the error up so
+    /// the rip terminates cleanly. Share the Arc with Drive::halt_flag() to get
+    /// unified Stop behavior across drive reads and sector processing.
+    halt: Option<Arc<AtomicBool>>,
+    event_fn: Option<Box<dyn Fn(Event) + Send>>,
     eof: bool,
 
+    // Cumulative bytes successfully read from the source. Drives
+    // EventKind::BytesRead emission and autorip's per-device progress.
+    bytes_read_total: u64,
+    // Pre-computed total of all extents in bytes (or 0 if extents are
+    // empty). Carried in EventKind::BytesRead.total so consumers can show
+    // a percent without a separate API call.
+    bytes_total_extents: u64,
+
     // PES output
     ts_demuxer: Option<super::ts::TsDemuxer>,
     ps_demuxer: Option<super::ps::PsDemuxer>,
@@ -44,103 +144,20 @@ pub struct DiscStream {
 }
 
 impl DiscStream {
-    /// Open from a physical drive. Caller must have already called
-    /// drive.wait_ready(), drive.init(), drive.probe_disc().
-    /// Drive is moved into the stream — caller manages lock/unlock before/after.
-    pub fn open_drive(
-        drive: crate::drive::Drive,
-        keydb_path: Option<&str>,
-        title_index: usize,
-    ) -> crate::error::Result<(Self, Disc)> {
-        let scan_opts = match keydb_path {
-            Some(kp) => ScanOptions::with_keydb(kp),
-            None => ScanOptions::default(),
-        };
-        let mut drive = drive;
-        let disc = Disc::scan(&mut drive, &scan_opts)?;
-
-        if title_index >= disc.titles.len() {
-            return Err(crate::error::Error::DiscTitleRange {
-                index: title_index,
-                count: disc.titles.len(),
-            });
-        }
-
-        let title = disc.titles[title_index].clone();
-        let keys = disc.decrypt_keys();
-        let max_batch = detect_max_batch_sectors(drive.device_path());
-        let content_format = disc.content_format;
-
-        let mut stream = Self::from_reader(Box::new(drive), title, keys, max_batch);
-
-        // Set demuxer based on content format
-        match content_format {
-            crate::disc::ContentFormat::MpegPs => {
-                stream.ps_demuxer = Some(super::ps::PsDemuxer::new());
-            }
-            crate::disc::ContentFormat::BdTs => {
-                let pids: Vec<u16> = stream.pid_to_track.iter().map(|(pid, _)| *pid).collect();
-                if !pids.is_empty() {
-                    stream.ts_demuxer = Some(super::ts::TsDemuxer::new(&pids));
-                }
-            }
-        }
-        Ok((stream, disc))
-    }
-
-    /// Open from an ISO file.
-    pub fn open_iso(
-        path: &str,
-        title_index: Option<usize>,
-        opts: &ScanOptions,
-    ) -> io::Result<Self> {
-        let mut reader = super::iso::IsoSectorReader::open(path)?;
-        let capacity = reader.capacity();
-
-        let disc =
-            Disc::scan_image(&mut reader, capacity, opts).map_err(|e| -> io::Error { e.into() })?;
-
-        if disc.titles.is_empty() {
-            return Err(crate::error::Error::NoStreams.into());
-        }
-        let idx = title_index.unwrap_or(0);
-        if idx >= disc.titles.len() {
-            return Err(crate::error::Error::DiscTitleRange {
-                index: idx,
-                count: disc.titles.len(),
-            }
-            .into());
-        }
-
-        let title = disc.titles[idx].clone();
-        let keys = disc.decrypt_keys();
-        let batch: u16 = 64;
-
-        let mut stream = Self::from_reader(Box::new(reader), title, keys, batch);
-        // Set demuxer based on content format
-        match disc.content_format {
-            crate::disc::ContentFormat::MpegPs => {
-                stream.ps_demuxer = Some(super::ps::PsDemuxer::new());
-            }
-            crate::disc::ContentFormat::BdTs => {
-                let pids: Vec<u16> = stream.pid_to_track.iter().map(|(pid, _)| *pid).collect();
-                if !pids.is_empty() {
-                    stream.ts_demuxer = Some(super::ts::TsDemuxer::new(&pids));
-                }
-            }
-        }
-        stream.disc = Some(disc);
-        Ok(stream)
-    }
-
-    /// Create from any SectorReader + title + keys.
-    pub fn from_reader(
+    /// Create a disc stream from any sector reader.
+    ///
+    /// Works with physical drives and ISO files — both implement SectorReader.
+    /// The caller opens the source, scans for titles/keys, and passes them in.
+    /// The stream handles demuxing, decryption, and codec parsing internally.
+    pub fn new(
         reader: Box<dyn SectorReader>,
         title: DiscTitle,
         decrypt_keys: crate::decrypt::DecryptKeys,
         batch_sectors: u16,
+        content_format: crate::disc::ContentFormat,
     ) -> Self {
         let extents = title.extents.clone();
+        let bytes_total_extents: u64 = extents.iter().map(|e| e.sector_count as u64 * 2048).sum();
 
         let mut pids = Vec::new();
         let mut parsers = Vec::new();
@@ -153,7 +170,21 @@ impl DiscStream {
             };
             pids.push(pid);
             pid_to_track.push((pid, idx));
-            parsers.push((pid, super::codec::parser_for_codec(codec)));
+            parsers.push((pid, super::codec::parser_for_codec(codec, None)));
+        }
+
+        let mut ts_demuxer = None;
+        let mut ps_demuxer = None;
+        match content_format {
+            crate::disc::ContentFormat::MpegPs => {
+                ps_demuxer = Some(super::ps::PsDemuxer::new());
+            }
+            crate::disc::ContentFormat::BdTs => {
+                let ts_pids: Vec<u16> = pids.clone();
+                if !ts_pids.is_empty() {
+                    ts_demuxer = Some(super::ts::TsDemuxer::new(&ts_pids));
+                }
+            }
         }
 
         Self {
@@ -166,19 +197,49 @@ impl DiscStream {
             current_offset: 0,
             read_buf: Vec::with_capacity(batch_sectors as usize * 2048),
             buf_valid: 0,
-            batch_sectors,
+            adaptive: AdaptiveBatch::new(batch_sectors),
             errors: 0,
+            skip_errors: false,
+            halt: None,
+            event_fn: None,
             eof: false,
-            // Demuxer set by caller — open_drive() checks content_format,
-            // open_iso() always uses TS (Blu-ray ISO).
-            ts_demuxer: None,
-            ps_demuxer: None,
+            bytes_read_total: 0,
+            bytes_total_extents,
+            ts_demuxer,
+            ps_demuxer,
             parsers,
             pending_frames: std::collections::VecDeque::new(),
             pid_to_track,
         }
     }
 
+    /// Set event handler for sector-level events (binary search, skip, recover).
+    pub fn on_event(&mut self, f: impl Fn(Event) + Send + 'static) {
+        self.event_fn = Some(Box::new(f));
+    }
+
+    /// Share a halt flag — typically from `Drive::halt_flag()`. When raised,
+    /// the next read-retry boundary inside fill_extents returns Err(Halted)
+    /// instead of continuing. Required for Stop to work during dense bad-sector
+    /// regions (where read() loops internally waiting for enough clean data to
+    /// emit a frame and would otherwise never check an external stop signal).
+    pub fn set_halt(&mut self, flag: Arc<AtomicBool>) {
+        self.halt = Some(flag);
+    }
+
+    fn is_halted(&self) -> bool {
+        self.halt
+            .as_ref()
+            .map(|h| h.load(Ordering::Relaxed))
+            .unwrap_or(false)
+    }
+
+    fn emit(&self, kind: EventKind) {
+        if let Some(ref f) = self.event_fn {
+            f(Event { kind });
+        }
+    }
+
     /// Skip decryption — return raw encrypted bytes.
     pub fn set_raw(&mut self) {
         self.decrypt_keys = crate::decrypt::DecryptKeys::None;
@@ -189,41 +250,88 @@ impl DiscStream {
         self.disc.as_ref()
     }
 
-    fn fill_extents(&mut self) -> bool {
+    fn fill_extents(&mut self) -> io::Result<bool> {
         if self.current_extent >= self.extents.len() {
-            return false;
+            return Ok(false);
         }
         let ext_start = self.extents[self.current_extent].start_lba;
         let ext_sectors = self.extents[self.current_extent].sector_count;
 
         let remaining = ext_sectors.saturating_sub(self.current_offset);
-        let sectors = remaining.min(self.batch_sectors as u32) as u16;
-        let sectors = sectors - (sectors % 3);
-        if sectors == 0 {
+        if remaining == 0 {
             self.current_extent += 1;
             self.current_offset = 0;
             return self.fill_extents();
         }
 
         let lba = ext_start + self.current_offset;
-        let bytes = sectors as usize * 2048;
-        self.read_buf.resize(bytes, 0);
 
-        match self
-            .reader
-            .read_sectors(lba, sectors, &mut self.read_buf[..bytes])
-        {
-            Ok(_) => {
+        // Adaptive sizer: start at current (preferred until a failure), shrink
+        // on failure, advance on success. One 5s read attempt per try — no
+        // retry loops, no sleeps. On size-1 failure, skip or error.
+        //
+        // Halt is checked at the top of every iteration — in a dense bad zone
+        // this loop can spend minutes shrinking and skipping sectors; without
+        // the check, Stop wouldn't take effect until the outer PES read() loop
+        // finally emits a frame, which may never happen.
+        loop {
+            if self.is_halted() {
+                return Err(crate::error::Error::Halted.into());
+            }
+            let mut sectors = remaining.min(self.adaptive.current() as u32) as u16;
+            // Align to 3-sector AACS units when possible. Partial units at
+            // extent boundaries are safely handled by decrypt_sectors().
+            if sectors >= 3 {
+                sectors -= sectors % 3;
+            }
+            let bytes = sectors as usize * 2048;
+            self.read_buf.resize(bytes, 0);
+
+            let ok = self
+                .reader
+                .read_sectors(lba, sectors, &mut self.read_buf[..bytes], false)
+                .is_ok();
+
+            if ok {
+                if let Some(ev) = self.adaptive.on_success(sectors) {
+                    self.emit(ev);
+                }
                 self.buf_valid = bytes;
                 self.current_offset += sectors as u32;
-                if self.current_offset >= ext_sectors {
-                    self.current_extent += 1;
-                    self.current_offset = 0;
+                self.bytes_read_total = self.bytes_read_total.saturating_add(bytes as u64);
+                self.emit(EventKind::BytesRead {
+                    bytes: self.bytes_read_total,
+                    total: self.bytes_total_extents,
+                });
+                break;
+            }
+
+            if sectors == 1 {
+                // Bottomed out. Skip this sector or bail.
+                if self.skip_errors {
+                    self.read_buf.resize(2048, 0);
+                    self.read_buf[..2048].fill(0);
+                    self.buf_valid = 2048;
+                    self.errors += 1;
+                    self.emit(EventKind::SectorSkipped { sector: lba as u64 });
+                    self.current_offset += 1;
+                    break;
+                } else {
+                    return Err(crate::error::Error::DiscRead { sector: lba as u64 }.into());
                 }
-                true
+            }
+
+            // Shrink and retry at the same LBA with a smaller batch.
+            if let Some(ev) = self.adaptive.on_failure() {
+                self.emit(ev);
             }
-            Err(_) => false,
         }
+
+        if self.current_offset >= ext_sectors {
+            self.current_extent += 1;
+            self.current_offset = 0;
+        }
+        Ok(true)
     }
 }
 
@@ -238,7 +346,7 @@ impl crate::pes::Stream for DiscStream {
         }
 
         loop {
-            if !self.fill_extents() {
+            if !self.fill_extents()? {
                 self.eof = true;
                 // Flush demuxer — last PES packet may still be in the assembler
                 if let Some(ref mut demuxer) = self.ts_demuxer {
@@ -285,8 +393,7 @@ impl crate::pes::Stream for DiscStream {
                             dts: ps.dts.map(|d| d as i64),
                             data: ps.data.clone(),
                         };
-                        if let Some((_, parser)) =
-                            self.parsers.iter_mut().find(|(p, _)| *p == pid)
+                        if let Some((_, parser)) = self.parsers.iter_mut().find(|(p, _)| *p == pid)
                         {
                             for frame in parser.parse(&pes) {
                                 self.pending_frames.push_back(
@@ -354,13 +461,10 @@ impl crate::pes::Stream for DiscStream {
                         data: ps.data.clone(),
                     };
 
-                    if let Some((_, parser)) =
-                        self.parsers.iter_mut().find(|(p, _)| *p == pid)
-                    {
+                    if let Some((_, parser)) = self.parsers.iter_mut().find(|(p, _)| *p == pid) {
                         for frame in parser.parse(&pes) {
-                            self.pending_frames.push_back(
-                                crate::pes::PesFrame::from_codec_frame(track, frame),
-                            );
+                            self.pending_frames
+                                .push_back(crate::pes::PesFrame::from_codec_frame(track, frame));
                         }
                     }
                 }

src/mux/ebml.rs

@@ -87,11 +87,6 @@ pub fn write_uint(w: &mut impl Write, id: u32, val: u64) -> io::Result<()> {
     }
 }
 
-/// Write a complete EBML signed integer element.
-pub fn write_int(w: &mut impl Write, id: u32, val: i64) -> io::Result<()> {
-    write_uint(w, id, val as u64)
-}
-
 /// Write a complete EBML float element (8-byte double).
 pub fn write_float(w: &mut impl Write, id: u32, val: f64) -> io::Result<()> {
     write_id(w, id)?;
@@ -309,22 +304,6 @@ pub fn read_binary_val(r: &mut impl Read, len: usize) -> io::Result<Vec<u8>> {
     Ok(buf)
 }
 
-/// Read a VINT (track number) from a SimpleBlock. Returns (value, bytes_consumed).
-pub fn read_vint(r: &mut impl Read) -> io::Result<(u64, usize)> {
-    let mut first = [0u8; 1];
-    r.read_exact(&mut first)?;
-    let b0 = first[0];
-    if b0 & 0x80 != 0 {
-        return Ok(((b0 & 0x7F) as u64, 1));
-    }
-    if b0 & 0x40 != 0 {
-        let mut b = [0u8; 1];
-        r.read_exact(&mut b)?;
-        return Ok(((((b0 & 0x3F) as u64) << 8) | b[0] as u64, 2));
-    }
-    Err(crate::error::Error::MkvInvalid.into())
-}
-
 // ============================================================
 // Matroska Element IDs
 // ============================================================
@@ -342,12 +321,6 @@ pub const EBML_DOC_TYPE_READ_VERSION: u32 = 0x4285;
 // Segment
 pub const SEGMENT: u32 = 0x1853_8067;
 
-// Seek Head
-pub const SEEK_HEAD: u32 = 0x114D_9B74;
-pub const SEEK: u32 = 0x4DBB;
-pub const SEEK_ID: u32 = 0x53AB;
-pub const SEEK_POSITION: u32 = 0x53AC;
-
 // Segment Info
 pub const INFO: u32 = 0x1549_A966;
 pub const TIMESTAMP_SCALE: u32 = 0x2A_D7B1;
@@ -441,7 +414,7 @@ mod tests {
     fn test_write_uint() {
         let mut buf = Vec::new();
         write_uint(&mut buf, 0x4286, 1).unwrap(); // EBML_VERSION = 1
-                                                  // ID: 42 86, Size: 81 (1 byte), Data: 01
+        // ID: 42 86, Size: 81 (1 byte), Data: 01
         assert_eq!(buf, [0x42, 0x86, 0x81, 0x01]);
     }
 

src/mux/iso.rs

@@ -19,8 +19,7 @@ pub struct IsoSectorReader {
 
 impl IsoSectorReader {
     pub fn open(path: &str) -> std::io::Result<Self> {
-        let file = File::open(Path::new(path))
-            .map_err(|e| std::io::Error::new(e.kind(), format!("iso://{path}: {e}")))?;
+        let file = File::open(Path::new(path))?;
         let size = file.metadata()?.len();
         let sectors = size / SECTOR_SIZE;
         if sectors > u32::MAX as u64 {
@@ -39,7 +38,13 @@ impl IsoSectorReader {
 }
 
 impl SectorReader for IsoSectorReader {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
         let bytes = count as usize * SECTOR_SIZE as usize;
         self.file
             .seek(SeekFrom::Start(lba as u64 * SECTOR_SIZE))
@@ -71,11 +76,11 @@ mod tests {
         assert_eq!(reader.capacity(), 4);
 
         let mut buf = [0u8; 2048];
-        reader.read_sectors(0, 1, &mut buf).unwrap();
+        reader.read_sectors(0, 1, &mut buf, true).unwrap();
         assert_eq!(buf[0], 1);
         assert_eq!(buf[2047], 100);
 
-        reader.read_sectors(2, 1, &mut buf).unwrap();
+        reader.read_sectors(2, 1, &mut buf, true).unwrap();
         assert_eq!(buf[0], 3);
         assert_eq!(buf[2047], 102);
 

src/mux/lookahead.rs

@@ -1,127 +0,0 @@
-//! LookaheadBuffer — generic pre-scan buffer for stream pipelines.
-//!
-//! Accumulates data up to a configurable limit. When the consumer finds
-//! what it needs, the buffer can be drained (fast path, no re-read).
-//! If the buffer fills before the consumer is satisfied, it signals
-//! overflow — the caller should discard and re-read from the source.
-//!
-//! Used by MkvStream to collect SPS/PPS before writing the MKV header.
-//! Reusable for any stream stage that needs to look ahead.
-
-/// Default lookahead buffer size: 5 MB.
-pub const DEFAULT_LOOKAHEAD_SIZE: usize = 5 * 1024 * 1024;
-
-/// Lookahead buffer states.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub enum LookaheadState {
-    /// Still collecting data, haven't found what we need yet.
-    Collecting,
-    /// Found what we need, buffer has the data ready to drain.
-    Ready,
-    /// Buffer overflowed before finding what we need.
-    /// Caller should discard buffer, finish scanning without buffering,
-    /// then re-read from the source.
-    Overflow,
-}
-
-/// A bounded lookahead buffer.
-pub struct LookaheadBuffer {
-    data: Vec<u8>,
-    max_size: usize,
-    state: LookaheadState,
-}
-
-impl LookaheadBuffer {
-    /// Create a new buffer with the given max size.
-    /// Pass 0 for no buffering (always overflows immediately).
-    pub fn new(max_size: usize) -> Self {
-        Self {
-            data: Vec::with_capacity(max_size.min(DEFAULT_LOOKAHEAD_SIZE)),
-            max_size,
-            state: LookaheadState::Collecting,
-        }
-    }
-
-    /// Push data into the buffer. Returns the new state.
-    /// If the buffer would overflow, transitions to Overflow state.
-    pub fn push(&mut self, chunk: &[u8]) -> LookaheadState {
-        if self.state != LookaheadState::Collecting {
-            return self.state;
-        }
-
-        if self.data.len() + chunk.len() > self.max_size {
-            self.state = LookaheadState::Overflow;
-            return self.state;
-        }
-
-        self.data.extend_from_slice(chunk);
-        self.state
-    }
-
-    /// Mark the buffer as ready — we found what we need.
-    pub fn mark_ready(&mut self) {
-        if self.state == LookaheadState::Collecting {
-            self.state = LookaheadState::Ready;
-        }
-    }
-
-    /// Get the buffered data (only valid in Ready state).
-    pub fn data(&self) -> &[u8] {
-        &self.data
-    }
-
-    /// Take ownership of the buffered data, clearing the buffer.
-    pub fn drain(&mut self) -> Vec<u8> {
-        self.state = LookaheadState::Collecting;
-        std::mem::take(&mut self.data)
-    }
-
-    /// Current state.
-    pub fn state(&self) -> LookaheadState {
-        self.state
-    }
-
-    /// How many bytes are buffered.
-    pub fn len(&self) -> usize {
-        self.data.len()
-    }
-
-    /// Is the buffer empty?
-    pub fn is_empty(&self) -> bool {
-        self.data.is_empty()
-    }
-
-    /// Max size this buffer can hold.
-    pub fn max_size(&self) -> usize {
-        self.max_size
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_basic_flow() {
-        let mut buf = LookaheadBuffer::new(100);
-        assert_eq!(buf.push(b"hello"), LookaheadState::Collecting);
-        assert_eq!(buf.push(b"world"), LookaheadState::Collecting);
-        assert_eq!(buf.len(), 10);
-        buf.mark_ready();
-        assert_eq!(buf.state(), LookaheadState::Ready);
-        assert_eq!(buf.data(), b"helloworld");
-    }
-
-    #[test]
-    fn test_overflow() {
-        let mut buf = LookaheadBuffer::new(5);
-        assert_eq!(buf.push(b"abc"), LookaheadState::Collecting);
-        assert_eq!(buf.push(b"def"), LookaheadState::Overflow);
-    }
-
-    #[test]
-    fn test_zero_size() {
-        let mut buf = LookaheadBuffer::new(0);
-        assert_eq!(buf.push(b"a"), LookaheadState::Overflow);
-    }
-}

src/mux/m2ts.rs

@@ -103,7 +103,7 @@ impl M2tsStream {
             };
             pids.push(pid);
             pid_to_track.push((pid, i));
-            parsers.push((pid, super::codec::parser_for_codec(codec)));
+            parsers.push((pid, super::codec::parser_for_codec(codec, None)));
         }
         (pids, parsers, pid_to_track)
     }

src/mux/meta.rs

@@ -173,6 +173,7 @@ impl M2tsMeta {
                         .parse()
                         .unwrap_or(crate::disc::SampleRate::Unknown),
                     secondary: *secondary,
+                    purpose: crate::disc::LabelPurpose::Normal,
                     label: label.clone(),
                 }),
                 MetaStream::Subtitle {
@@ -185,6 +186,7 @@ impl M2tsMeta {
                     codec: codec.parse().unwrap_or(crate::disc::Codec::Unknown(0)),
                     language: language.clone(),
                     forced: *forced,
+                    qualifier: crate::disc::LabelQualifier::None,
                     codec_data: None,
                 }),
             })
@@ -211,7 +213,7 @@ impl M2tsMeta {
             .iter()
             .map(|s| {
                 if let MetaStream::Video {
-                    codec_private: Some(ref b64),
+                    codec_private: Some(b64),
                     ..
                 } = s
                 {

src/mux/mkv.rs

@@ -5,8 +5,10 @@
 //! cues and seek head are finalized at the end.
 
 use super::ebml;
-use crate::disc::{AudioStream, Chapter, Codec, SubtitleStream, VideoStream};
-use std::io::{self, Seek, SeekFrom, Write};
+use crate::disc::{
+    AudioStream, Chapter, Codec, ColorSpace, HdrFormat, SubtitleStream, VideoStream,
+};
+use std::io::{self, Seek, Write};
 
 /// MKV track definition (built from disc stream metadata).
 pub struct MkvTrack {
@@ -20,6 +22,14 @@ pub struct MkvTrack {
     // Video-specific
     pub pixel_width: u32,
     pub pixel_height: u32,
+    pub default_duration_ns: u64, // nanoseconds per frame (0 = unknown)
+    pub display_width: u32,       // display aspect ratio width (0 = same as pixel)
+    pub display_height: u32,      // display aspect ratio height (0 = same as pixel)
+    // HDR colour metadata
+    pub colour_matrix: u8,    // MatrixCoefficients (9=bt2020nc)
+    pub colour_transfer: u8,  // TransferCharacteristics (16=smpte2084/PQ)
+    pub colour_primaries: u8, // Primaries (9=bt2020)
+    pub colour_range: u8,     // Range (1=tv/limited)
     // Audio-specific
     pub sample_rate: f64,
     pub channels: u8,
@@ -36,16 +46,40 @@ impl MkvTrack {
             _ => "V_MPEG2",
         };
         let (w, h) = v.resolution.pixels();
+        let (num, den) = v.frame_rate.as_fraction();
+        let default_duration_ns = if num > 0 {
+            (1_000_000_000u64 * den as u64) / num as u64
+        } else {
+            0
+        };
+        let (matrix, transfer, primaries, range) = match v.color_space {
+            ColorSpace::Bt2020 => (9, 16, 9, 1), // bt2020nc, PQ, bt2020, limited
+            ColorSpace::Bt709 => (1, 1, 1, 1),   // bt709
+            ColorSpace::Unknown => (0, 0, 0, 0),
+        };
+        // Override transfer for non-PQ HDR
+        let transfer = match v.hdr {
+            HdrFormat::Hdr10 | HdrFormat::Hdr10Plus | HdrFormat::DolbyVision => 16, // PQ
+            HdrFormat::Hlg => 18,
+            _ => transfer,
+        };
         Self {
             track_type: ebml::TRACK_TYPE_VIDEO,
             codec_id,
             language: "und".into(),
             name: v.label.clone(),
-            codec_private: None, // filled later by parser
+            codec_private: None,
             is_default: !v.secondary,
             is_forced: false,
             pixel_width: w,
             pixel_height: h,
+            default_duration_ns,
+            display_width: w,
+            display_height: h,
+            colour_matrix: matrix,
+            colour_transfer: transfer,
+            colour_primaries: primaries,
+            colour_range: range,
             sample_rate: 0.0,
             channels: 0,
             bit_depth: 0,
@@ -63,16 +97,26 @@ impl MkvTrack {
         };
         let sr = a.sample_rate.hz();
         let ch = a.channels.count();
+
+        let name = a.label.clone();
+
         Self {
             track_type: ebml::TRACK_TYPE_AUDIO,
             codec_id,
             language: a.language.clone(),
-            name: a.label.clone(),
+            name,
             codec_private: None,
             is_default: !a.secondary,
             is_forced: false,
             pixel_width: 0,
             pixel_height: 0,
+            default_duration_ns: 0,
+            display_width: 0,
+            display_height: 0,
+            colour_matrix: 0,
+            colour_transfer: 0,
+            colour_primaries: 0,
+            colour_range: 0,
             sample_rate: sr,
             channels: ch,
             bit_depth: 0,
@@ -94,6 +138,13 @@ impl MkvTrack {
             is_forced: s.forced,
             pixel_width: 0,
             pixel_height: 0,
+            default_duration_ns: 0,
+            display_width: 0,
+            display_height: 0,
+            colour_matrix: 0,
+            colour_transfer: 0,
+            colour_primaries: 0,
+            colour_range: 0,
             sample_rate: 0.0,
             channels: 0,
             bit_depth: 0,
@@ -116,12 +167,9 @@ pub struct MkvMuxer<W: Write + Seek> {
     cluster_pos: u64,
     cluster_size_pos: u64,
     cluster_ts_ms: i64,
+    base_pts_ms: Option<i64>,
     cues: Vec<CuePoint>,
     frame_count: u64,
-    /// File positions of codecPrivate placeholders (track_idx → offset, max_size).
-    /// Used to seek back and fill in SPS/PPS after first keyframe.
-    codec_private_slots: Vec<Option<(u64, usize)>>,
-    codec_private_filled: Vec<bool>,
 }
 
 /// New cluster every 5 seconds.
@@ -130,16 +178,6 @@ const CLUSTER_DURATION_MS: i64 = 5000;
 impl<W: Write + Seek> MkvMuxer<W> {
     /// Create a new MKV muxer: writes EBML header, Segment start, Info, Tracks, Chapters.
     pub fn new(
-        writer: W,
-        tracks: &[MkvTrack],
-        title: Option<&str>,
-        duration_secs: f64,
-    ) -> io::Result<Self> {
-        Self::new_with_chapters(writer, tracks, title, duration_secs, &[])
-    }
-
-    /// Create a new MKV muxer with chapters: writes EBML header, Segment start, Info, Tracks, Chapters.
-    pub fn new_with_chapters(
         mut writer: W,
         tracks: &[MkvTrack],
         title: Option<&str>,
@@ -177,8 +215,6 @@ impl<W: Write + Seek> MkvMuxer<W> {
         ebml::end_master(&mut writer, info_pos)?;
 
         // Tracks
-        let mut codec_private_slots: Vec<Option<(u64, usize)>> = Vec::new();
-        let mut codec_private_filled: Vec<bool> = Vec::new();
         let tracks_pos = ebml::start_master(&mut writer, ebml::TRACKS)?;
         for (i, track) in tracks.iter().enumerate() {
             let entry_pos = ebml::start_master(&mut writer, ebml::TRACK_ENTRY)?;
@@ -201,19 +237,20 @@ impl<W: Write + Seek> MkvMuxer<W> {
 
             if let Some(ref cp) = track.codec_private {
                 ebml::write_binary(&mut writer, ebml::CODEC_PRIVATE, cp)?;
-                codec_private_slots.push(None); // already filled
-                codec_private_filled.push(true);
-            } else if track.track_type == ebml::TRACK_TYPE_VIDEO {
-                // Reserve space for codecPrivate — will be filled after first keyframe
-                // Reserve 256 bytes (enough for SPS+PPS or VPS+SPS+PPS)
-                let cp_pos = writer.stream_position()?;
-                let placeholder = vec![0u8; 256];
-                ebml::write_binary(&mut writer, ebml::CODEC_PRIVATE, &placeholder)?;
-                codec_private_slots.push(Some((cp_pos, 256)));
-                codec_private_filled.push(false);
-            } else {
-                codec_private_slots.push(None);
-                codec_private_filled.push(true);
+            }
+            // Pre-0.13 a deferred codecPrivate path existed for video tracks
+            // (placeholder reserve + later seek-back fill via
+            // `fill_codec_private`). The PES pipeline hands codec_private
+            // up-front via the DiscTitle, so the deferred path was never
+            // exercised — removed in the 0.13 dead-code sweep.
+
+            // DefaultDuration — frame duration in nanoseconds
+            if track.default_duration_ns > 0 {
+                ebml::write_uint(
+                    &mut writer,
+                    ebml::DEFAULT_DURATION,
+                    track.default_duration_ns,
+                )?;
             }
 
             // Video-specific
@@ -221,6 +258,31 @@ impl<W: Write + Seek> MkvMuxer<W> {
                 let vid_pos = ebml::start_master(&mut writer, ebml::VIDEO)?;
                 ebml::write_uint(&mut writer, ebml::PIXEL_WIDTH, track.pixel_width as u64)?;
                 ebml::write_uint(&mut writer, ebml::PIXEL_HEIGHT, track.pixel_height as u64)?;
+                if track.display_width > 0 && track.display_height > 0 {
+                    ebml::write_uint(&mut writer, ebml::DISPLAY_WIDTH, track.display_width as u64)?;
+                    ebml::write_uint(
+                        &mut writer,
+                        ebml::DISPLAY_HEIGHT,
+                        track.display_height as u64,
+                    )?;
+                }
+                // Colour metadata (HDR)
+                if track.colour_matrix > 0 || track.colour_transfer > 0 {
+                    let col_pos = ebml::start_master(&mut writer, ebml::COLOUR)?;
+                    ebml::write_uint(
+                        &mut writer,
+                        ebml::MATRIX_COEFFICIENTS,
+                        track.colour_matrix as u64,
+                    )?;
+                    ebml::write_uint(
+                        &mut writer,
+                        ebml::TRANSFER_CHARACTERISTICS,
+                        track.colour_transfer as u64,
+                    )?;
+                    ebml::write_uint(&mut writer, ebml::PRIMARIES, track.colour_primaries as u64)?;
+                    ebml::write_uint(&mut writer, ebml::RANGE, track.colour_range as u64)?;
+                    ebml::end_master(&mut writer, col_pos)?;
+                }
                 ebml::end_master(&mut writer, vid_pos)?;
             }
 
@@ -265,10 +327,9 @@ impl<W: Write + Seek> MkvMuxer<W> {
             cluster_pos: 0,
             cluster_size_pos: 0,
             cluster_ts_ms: 0,
+            base_pts_ms: None,
             cues: Vec::new(),
             frame_count: 0,
-            codec_private_slots,
-            codec_private_filled,
         })
     }
 
@@ -280,7 +341,9 @@ impl<W: Write + Seek> MkvMuxer<W> {
         keyframe: bool,
         data: &[u8],
     ) -> io::Result<()> {
-        let pts_ms = pts_ns / 1_000_000;
+        let raw_ms = pts_ns / 1_000_000;
+        let base = *self.base_pts_ms.get_or_insert(raw_ms);
+        let pts_ms = raw_ms - base;
 
         // Start new cluster if needed
         if !self.cluster_open || (pts_ms - self.cluster_ts_ms) >= CLUSTER_DURATION_MS {
@@ -336,30 +399,6 @@ impl<W: Write + Seek> MkvMuxer<W> {
         Ok(())
     }
 
-    /// Fill in a deferred codecPrivate for a track.
-    /// Seeks back to the placeholder, writes the actual data, restores position.
-    pub fn fill_codec_private(&mut self, track_idx: usize, data: &[u8]) -> io::Result<()> {
-        if track_idx >= self.codec_private_filled.len() || self.codec_private_filled[track_idx] {
-            return Ok(());
-        }
-        if let Some((pos, max_size)) = self.codec_private_slots[track_idx] {
-            if data.len() > max_size {
-                // Data too large for reserved space — can't fill in place
-                // This shouldn't happen with 256 bytes reserved
-                return Ok(());
-            }
-            let current = self.writer.stream_position()?;
-            self.writer.seek(SeekFrom::Start(pos))?;
-            // Rewrite: element ID + size + data + zero-pad remainder
-            let mut padded = data.to_vec();
-            padded.resize(max_size, 0);
-            ebml::write_binary(&mut self.writer, ebml::CODEC_PRIVATE, &padded)?;
-            self.writer.seek(SeekFrom::Start(current))?;
-            self.codec_private_filled[track_idx] = true;
-        }
-        Ok(())
-    }
-
     fn start_cluster(&mut self, ts_ms: i64) -> io::Result<()> {
         // Close previous cluster if open
         if self.cluster_open {
@@ -450,6 +489,13 @@ mod tests {
             is_forced: false,
             pixel_width: 1920,
             pixel_height: 1080,
+            default_duration_ns: 41708333,
+            display_width: 1920,
+            display_height: 1080,
+            colour_matrix: 0,
+            colour_transfer: 0,
+            colour_primaries: 0,
+            colour_range: 0,
             sample_rate: 0.0,
             channels: 0,
             bit_depth: 0,
@@ -467,6 +513,13 @@ mod tests {
             is_forced: false,
             pixel_width: 0,
             pixel_height: 0,
+            default_duration_ns: 0,
+            display_width: 0,
+            display_height: 0,
+            colour_matrix: 0,
+            colour_transfer: 0,
+            colour_primaries: 0,
+            colour_range: 0,
             sample_rate: 48000.0,
             channels: 6,
             bit_depth: 0,
@@ -477,7 +530,7 @@ mod tests {
     fn mkv_writes_ebml_header() {
         let buf = Cursor::new(Vec::new());
         let tracks = [make_video_track()];
-        let muxer = MkvMuxer::new(buf, &tracks, Some("Test"), 120.0).unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, Some("Test"), 120.0, &[]).unwrap();
         let data = muxer.writer.into_inner();
         // EBML header element ID: 0x1A45DFA3
         assert!(data.len() >= 4);
@@ -488,7 +541,7 @@ mod tests {
     fn mkv_writes_segment() {
         let buf = Cursor::new(Vec::new());
         let tracks = [make_video_track()];
-        let muxer = MkvMuxer::new(buf, &tracks, None, 0.0).unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, None, 0.0, &[]).unwrap();
         let data = muxer.writer.into_inner();
         // Segment element ID: 0x18538067
         assert!(
@@ -501,7 +554,7 @@ mod tests {
     fn mkv_write_frame_creates_cluster() {
         let buf = Cursor::new(Vec::new());
         let tracks = [make_video_track()];
-        let mut muxer = MkvMuxer::new(buf, &tracks, None, 60.0).unwrap();
+        let mut muxer = MkvMuxer::new(buf, &tracks, None, 60.0, &[]).unwrap();
         muxer
             .write_frame(0, 0, true, &[0xDE, 0xAD, 0xBE, 0xEF])
             .unwrap();
@@ -540,7 +593,7 @@ mod tests {
         let shared = Arc::new(Mutex::new(Cursor::new(Vec::new())));
         let writer = SharedWriter(shared.clone());
         let tracks = [make_video_track()];
-        let mut muxer = MkvMuxer::new(writer, &tracks, Some("Cue Test"), 60.0).unwrap();
+        let mut muxer = MkvMuxer::new(writer, &tracks, Some("Cue Test"), 60.0, &[]).unwrap();
         muxer.write_frame(0, 0, true, &[0x01, 0x02, 0x03]).unwrap();
         muxer.finish().unwrap();
 
@@ -555,7 +608,7 @@ mod tests {
     fn mkv_multiple_tracks() {
         let buf = Cursor::new(Vec::new());
         let tracks = [make_video_track(), make_audio_track()];
-        let mut muxer = MkvMuxer::new(buf, &tracks, Some("Multi"), 120.0).unwrap();
+        let mut muxer = MkvMuxer::new(buf, &tracks, Some("Multi"), 120.0, &[]).unwrap();
         // Write frames to both tracks
         muxer.write_frame(0, 0, true, &[0x00, 0x00, 0x01]).unwrap();
         muxer.write_frame(1, 0, false, &[0x0B, 0x77, 0x00]).unwrap();
@@ -574,7 +627,7 @@ mod tests {
     fn mkv_keyframe_flag() {
         let buf = Cursor::new(Vec::new());
         let tracks = [make_video_track()];
-        let mut muxer = MkvMuxer::new(buf, &tracks, None, 10.0).unwrap();
+        let mut muxer = MkvMuxer::new(buf, &tracks, None, 10.0, &[]).unwrap();
 
         // Record position before first frame
         let pos_before_kf = muxer.writer.position();
@@ -606,7 +659,7 @@ mod tests {
             // Track VINT: 1 byte (track 1 = 0x81)
             let track_vint_pos = after_id + size_len;
             let track_vint_len = 1; // track 1 encoded as 0x81
-                                    // 2-byte relative timestamp
+            // 2-byte relative timestamp
             let ts_pos = track_vint_pos + track_vint_len;
             // flags byte
             let flags_pos = ts_pos + 2;
@@ -648,9 +701,7 @@ mod tests {
                 name: "Chapter 3".into(),
             },
         ];
-        let muxer =
-            MkvMuxer::new_with_chapters(buf, &tracks, Some("Chapter Test"), 900.0, &chapters)
-                .unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, Some("Chapter Test"), 900.0, &chapters).unwrap();
         let data = muxer.writer.into_inner();
 
         // Chapters element ID: 0x1043A770
@@ -674,7 +725,7 @@ mod tests {
     fn mkv_no_chapters_when_empty() {
         let buf = Cursor::new(Vec::new());
         let tracks = [make_video_track()];
-        let muxer = MkvMuxer::new(buf, &tracks, Some("No Chapters"), 60.0).unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, Some("No Chapters"), 60.0, &[]).unwrap();
         let data = muxer.writer.into_inner();
         assert!(
             find_id(&data, ebml::CHAPTERS).is_none(),
@@ -693,7 +744,7 @@ mod tests {
 
         let buf = Cursor::new(Vec::new());
         let tracks = [video, audio1, audio2];
-        let muxer = MkvMuxer::new(buf, &tracks, None, 60.0).unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, None, 60.0, &[]).unwrap();
         let data = muxer.writer.into_inner();
 
         // FlagDefault ID is 0x88. When is_default is true, FlagDefault is NOT written
@@ -719,13 +770,14 @@ mod tests {
             codec: Codec::Pgs,
             language: "eng".into(),
             forced: true,
+            qualifier: crate::disc::LabelQualifier::Forced,
             codec_data: None,
         });
         assert!(forced_sub.is_forced);
 
         let buf = Cursor::new(Vec::new());
         let tracks = [video, forced_sub];
-        let muxer = MkvMuxer::new(buf, &tracks, None, 60.0).unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, None, 60.0, &[]).unwrap();
         let data = muxer.writer.into_inner();
 
         // FlagForced ID: 0x55AA (2-byte ID)
@@ -744,13 +796,14 @@ mod tests {
             codec: Codec::Pgs,
             language: "eng".into(),
             forced: false,
+            qualifier: crate::disc::LabelQualifier::None,
             codec_data: None,
         });
         assert!(!sub.is_forced);
 
         let buf = Cursor::new(Vec::new());
         let tracks = [video, sub];
-        let muxer = MkvMuxer::new(buf, &tracks, None, 60.0).unwrap();
+        let muxer = MkvMuxer::new(buf, &tracks, None, 60.0, &[]).unwrap();
         let data = muxer.writer.into_inner();
 
         // FlagForced should NOT be written for non-forced tracks

src/mux/mkvstream.rs

@@ -4,7 +4,7 @@
 //! Write: PES frames in → MKV mux → Matroska container.
 
 use super::mkv::{MkvMuxer, MkvTrack};
-use super::{ebml, WriteSeek};
+use super::{WriteSeek, ebml};
 
 type MkvHeaderResult = io::Result<(crate::disc::DiscTitle, Vec<(u16, Vec<u8>)>)>;
 
@@ -42,19 +42,29 @@ impl MkvStream {
     /// Codec privates come from title.codec_privates (populated by input stream).
     pub fn create(writer: Box<dyn WriteSeek>, title: &DiscTitle) -> io::Result<Self> {
         let mut tracks = Vec::new();
+        let mut has_default_video = false;
+        let mut has_default_audio = false;
         for (idx, s) in title.streams.iter().enumerate() {
             let mut track = match s {
                 crate::disc::Stream::Video(v) => MkvTrack::video(v),
                 crate::disc::Stream::Audio(a) => MkvTrack::audio(a),
                 crate::disc::Stream::Subtitle(s) => MkvTrack::subtitle(s),
             };
+            // Only first video and first audio are default
+            if track.is_default {
+                match track.track_type {
+                    1 if !has_default_video => has_default_video = true,
+                    2 if !has_default_audio => has_default_audio = true,
+                    _ => track.is_default = false,
+                }
+            }
             if let Some(cp) = title.codec_privates.get(idx).and_then(|c| c.as_ref()) {
                 track.codec_private = Some(cp.clone());
             }
             tracks.push(track);
         }
 
-        let muxer = MkvMuxer::new_with_chapters(
+        let muxer = MkvMuxer::new(
             writer,
             &tracks,
             Some(&title.playlist),
@@ -140,9 +150,9 @@ impl crate::pes::Stream for MkvStream {
 
     fn write(&mut self, frame: &crate::pes::PesFrame) -> io::Result<()> {
         match &mut self.mode {
-            Mode::Write {
-                muxer: Some(ref mut m),
-            } => m.write_frame(frame.track, frame.pts, frame.keyframe, &frame.data),
+            Mode::Write { muxer: Some(m) } => {
+                m.write_frame(frame.track, frame.pts, frame.keyframe, &frame.data)
+            }
             Mode::Write { muxer: None } => Ok(()),
             Mode::Read(_) => Err(crate::error::Error::StreamReadOnly.into()),
         }
@@ -370,6 +380,7 @@ fn parse_track(
             language: lang,
             sample_rate: srs,
             secondary: false,
+            purpose: crate::disc::LabelPurpose::Normal,
             label: name,
         })),
         17 => Some(crate::disc::Stream::Subtitle(SubtitleStream {
@@ -377,6 +388,7 @@ fn parse_track(
             codec,
             language: lang,
             forced,
+            qualifier: crate::disc::LabelQualifier::None,
             codec_data: None,
         })),
         _ => None,

src/mux/mod.rs

@@ -15,22 +15,32 @@
 //!
 //! For disc→ISO (raw sector copy), use `Disc::copy()` instead.
 
+// Public modules — types here are intentionally part of the consumable API.
 pub mod codec;
 pub mod disc;
-pub mod ebml;
 pub mod iso;
-mod m2ts;
-pub mod meta;
-pub mod mkv;
-mod mkvstream;
-pub mod network;
-pub mod null;
-pub mod ps;
 pub mod resolve;
-pub mod stdio;
-pub mod ts;
-pub mod tsmux;
-pub mod tsreader;
+
+// Internal modules — implementation details. Their *types* are re-exported
+// where appropriate (`MkvStream`, `M2tsStream`, etc. surface from `lib.rs`),
+// but the module paths themselves are not part of the API. Pre-0.13 these
+// were `pub`, leaking low-level EBML primitives, TS muxer internals, and
+// network/stdio implementations that no external caller had business
+// reaching for.
+pub(crate) mod ebml;
+pub(crate) mod m2ts;
+/// FMKV metadata header (used by `M2tsStream` / `NetworkStream` / `StdioStream`
+/// to round-trip codec_privates that don't fit inside the underlying format).
+/// Exposed for integration tests that exercise the wire format directly.
+pub mod meta;
+pub(crate) mod mkv;
+pub(crate) mod mkvstream;
+pub(crate) mod network;
+pub(crate) mod null;
+pub(crate) mod ps;
+pub(crate) mod stdio;
+pub(crate) mod ts;
+pub(crate) mod tsmux;
 
 pub use disc::DiscStream;
 pub use iso::IsoSectorReader;
@@ -38,11 +48,18 @@ pub use m2ts::M2tsStream;
 pub use mkvstream::MkvStream;
 pub use network::NetworkStream;
 pub use null::NullStream;
-pub use resolve::{input, output, parse_url, InputOptions, StreamUrl};
+pub use resolve::{InputOptions, StreamUrl, input, output, parse_url};
 pub use stdio::StdioStream;
 
 use std::io::{Seek, Write};
 
-// WriteSeek — used internally by MKV muxer (container format requires seeking).
+/// Combined `Write + Seek` for sinks accepted by the MKV muxer.
+///
+/// Matroska's `SeekHead`, `Cues`, and `Cluster` size fields are written with
+/// placeholder values during streaming and updated in-place at finalization,
+/// so the output sink must support seeking. Provided as a single trait
+/// alias so callers don't have to repeat `Write + Seek` everywhere; the
+/// blanket impl below opts every `T: Write + Seek` in automatically
+/// (`File`, `BufWriter<File>`, `Cursor<Vec<u8>>`).
 pub trait WriteSeek: Write + Seek {}
 impl<T: Write + Seek> WriteSeek for T {}

src/mux/network.rs

@@ -81,7 +81,7 @@ impl crate::pes::Stream for NetworkStream {
         match &mut self.mode {
             Mode::Write {
                 writer,
-                ref mut header_written,
+                header_written,
                 ..
             } => {
                 if !*header_written {
@@ -144,6 +144,7 @@ mod tests {
                     language: "eng".into(),
                     sample_rate: SampleRate::S48,
                     secondary: false,
+                    purpose: crate::disc::LabelPurpose::Normal,
                     label: "English".into(),
                 }),
             ],

src/mux/resolve.rs

@@ -170,41 +170,40 @@ pub struct InputOptions {
 pub fn input(url: &str, opts: &InputOptions) -> io::Result<Box<dyn crate::pes::Stream>> {
     let parsed = parse_url(url);
     match parsed {
-        StreamUrl::Disc { device } => {
-            // Open drive, init, scan — caller manages the drive
-            let mut drive = match device {
-                Some(ref d) => {
-                    crate::drive::Drive::open(d).map_err(|e| -> io::Error { e.into() })?
-                }
-                None => crate::drive::find_drive().ok_or_else(|| -> io::Error {
-                    crate::error::Error::DeviceNotFound {
-                        path: String::new(),
-                    }
-                    .into()
-                })?,
-            };
-            let _ = drive.wait_ready();
-            let _ = drive.init();
-            let _ = drive.probe_disc();
-            let (mut stream, _disc) = DiscStream::open_drive(
-                drive,
-                opts.keydb_path.as_deref(),
-                opts.title_index.unwrap_or(0),
-            )
-            .map_err(|e| -> io::Error { e.into() })?;
-            if opts.raw {
-                stream.set_raw();
-            }
-            Ok(Box::new(stream))
+        StreamUrl::Disc { .. } => {
+            // Disc sources require live SCSI state — caller must use
+            // `Drive::open() + Disc::scan() + DiscStream::new()` directly.
+            // Surfaced as a typed error (no English commentary in the
+            // library; the CLI/UI explains the right entry point).
+            Err(crate::error::Error::DiscUrlNotDirect.into())
         }
         StreamUrl::Iso { ref path } => {
             validate_file_path(path, "iso")?;
             let scan_opts = match &opts.keydb_path {
-                Some(p) => crate::disc::ScanOptions::with_keydb(p),
+                Some(p) => crate::disc::ScanOptions {
+                    keydb_path: Some(p.into()),
+                },
                 None => crate::disc::ScanOptions::default(),
             };
-            let mut stream =
-                DiscStream::open_iso(&path.to_string_lossy(), opts.title_index, &scan_opts)?;
+            let mut reader = super::iso::IsoSectorReader::open(&path.to_string_lossy())?;
+            let capacity = reader.capacity();
+            let disc = crate::disc::Disc::scan_image(&mut reader, capacity, &scan_opts)
+                .map_err(|e| -> io::Error { e.into() })?;
+            if disc.titles.is_empty() {
+                return Err(crate::error::Error::NoStreams.into());
+            }
+            let idx = opts.title_index.unwrap_or(0);
+            if idx >= disc.titles.len() {
+                return Err(crate::error::Error::DiscTitleRange {
+                    index: idx,
+                    count: disc.titles.len(),
+                }
+                .into());
+            }
+            let title = disc.titles[idx].clone();
+            let keys = disc.decrypt_keys();
+            let format = disc.content_format;
+            let mut stream = DiscStream::new(Box::new(reader), title, keys, 64, format);
             if opts.raw {
                 stream.set_raw();
             }
@@ -212,17 +211,13 @@ pub fn input(url: &str, opts: &InputOptions) -> io::Result<Box<dyn crate::pes::S
         }
         StreamUrl::M2ts { ref path } => {
             validate_file_path(path, "m2ts")?;
-            let file = std::fs::File::open(path).map_err(|e| {
-                io::Error::new(e.kind(), format!("m2ts://{}: {}", path.display(), e))
-            })?;
+            let file = std::fs::File::open(path)?;
             let reader = std::io::BufReader::with_capacity(IO_BUF_SIZE, file);
             Ok(Box::new(M2tsStream::open(reader)?))
         }
         StreamUrl::Mkv { ref path } => {
             validate_file_path(path, "mkv")?;
-            let file = std::fs::File::open(path).map_err(|e| {
-                io::Error::new(e.kind(), format!("mkv://{}: {}", path.display(), e))
-            })?;
+            let file = std::fs::File::open(path)?;
             let reader = std::io::BufReader::with_capacity(IO_BUF_SIZE, file);
             Ok(Box::new(MkvStream::open(reader)?))
         }
@@ -247,18 +242,14 @@ pub fn output(
     match parsed {
         StreamUrl::Mkv { ref path } => {
             validate_file_path(path, "mkv")?;
-            let file = std::fs::File::create(path).map_err(|e| {
-                io::Error::new(e.kind(), format!("mkv://{}: {}", path.display(), e))
-            })?;
+            let file = std::fs::File::create(path)?;
             let writer: Box<dyn super::WriteSeek> =
                 Box::new(std::io::BufWriter::with_capacity(IO_BUF_SIZE, file));
             Ok(Box::new(MkvStream::create(writer, title)?))
         }
         StreamUrl::M2ts { ref path } => {
             validate_file_path(path, "m2ts")?;
-            let file = std::fs::File::create(path).map_err(|e| {
-                io::Error::new(e.kind(), format!("m2ts://{}: {}", path.display(), e))
-            })?;
+            let file = std::fs::File::create(path)?;
             let writer = std::io::BufWriter::with_capacity(IO_BUF_SIZE, file);
             Ok(Box::new(M2tsStream::create(writer, title)?))
         }

src/mux/stdio.rs

@@ -70,7 +70,7 @@ impl crate::pes::Stream for StdioStream {
     }
     fn write(&mut self, frame: &crate::pes::PesFrame) -> io::Result<()> {
         match &mut self.writer {
-            Some(ref mut w) => {
+            Some(w) => {
                 if !self.header_written {
                     if !self.disc_title.streams.is_empty() {
                         let m = meta::M2tsMeta::from_title(&self.disc_title);

src/mux/ts.rs

@@ -15,12 +15,6 @@ const TS_PACKET_SIZE: usize = 188;
 /// TS sync byte.
 const SYNC_BYTE: u8 = 0x47;
 
-/// Size of head buffer for PTS/stream scanning (1 MB).
-const SCAN_HEAD_SIZE: usize = 1024 * 1024;
-
-/// Size of tail buffer for last-PTS scanning (2 MB).
-const SCAN_TAIL_SIZE: usize = 2 * 1024 * 1024;
-
 /// A reassembled PES packet with timestamp info.
 #[derive(Debug)]
 pub struct PesPacket {
@@ -100,23 +94,20 @@ impl PesAssembler {
 pub struct TsDemuxer {
     assemblers: Vec<PesAssembler>,
     pid_index: Vec<i16>, // PID → index into assemblers, -1 = not tracked
-    remainder: Vec<u8>,     // leftover bytes from previous feed() call
+    remainder: Vec<u8>,  // leftover bytes from previous feed() call
 }
 
 impl TsDemuxer {
-    /// Take the remainder bytes (leftover from last feed() that didn't
-    /// align to a 192-byte packet boundary).
-    pub fn take_remainder(&mut self) -> Vec<u8> {
-        std::mem::take(&mut self.remainder)
-    }
-
-    /// Set the remainder bytes. Used to transfer alignment state from
-    /// one demuxer to another without losing sync.
-    pub fn set_remainder(&mut self, data: Vec<u8>) {
-        self.remainder = data;
-    }
-
     /// Create a new demuxer tracking the given PIDs.
+    ///
+    /// Allocates a flat lookup table of `i16` slots — one per possible PID
+    /// up to `max(8192, max_pid + 1)`. The 8192 floor matches the BD-TS
+    /// 13-bit PID space (0..0x1FFF); the variable upper bound exists for
+    /// DVD program streams which may use 16-bit stream IDs above 8191.
+    /// Worst-case allocation is `u16::MAX × 2 bytes ≈ 128 KB` — bounded by
+    /// the type, so adversarial input can't drive this beyond predictable
+    /// limits. Empty `pids` yields max_pid 0; the floor still produces a
+    /// valid (wholly-unused) table.
     pub fn new(pids: &[u16]) -> Self {
         let max_pid = pids.iter().copied().max().unwrap_or(0) as usize;
         let table_size = (max_pid + 1).max(8192);
@@ -446,6 +437,7 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
                         language: "und".into(),
                         sample_rate: SampleRate::S48,
                         secondary: false,
+                        purpose: crate::disc::LabelPurpose::Normal,
                         label: String::new(),
                     })),
                     0x83 => Some(Stream::Audio(AudioStream {
@@ -455,6 +447,7 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
                         language: "und".into(),
                         sample_rate: SampleRate::S48,
                         secondary: false,
+                        purpose: crate::disc::LabelPurpose::Normal,
                         label: String::new(),
                     })),
                     0x84 | 0xA1 => Some(Stream::Audio(AudioStream {
@@ -464,6 +457,7 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
                         language: "und".into(),
                         sample_rate: SampleRate::S48,
                         secondary: false,
+                        purpose: crate::disc::LabelPurpose::Normal,
                         label: String::new(),
                     })),
                     0x85 | 0x86 => Some(Stream::Audio(AudioStream {
@@ -473,6 +467,7 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
                         language: "und".into(),
                         sample_rate: SampleRate::S48,
                         secondary: false,
+                        purpose: crate::disc::LabelPurpose::Normal,
                         label: String::new(),
                     })),
                     0x82 => Some(Stream::Audio(AudioStream {
@@ -482,6 +477,7 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
                         language: "und".into(),
                         sample_rate: SampleRate::S48,
                         secondary: false,
+                        purpose: crate::disc::LabelPurpose::Normal,
                         label: String::new(),
                     })),
                     0x90 => Some(Stream::Subtitle(SubtitleStream {
@@ -489,6 +485,7 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
                         codec: Codec::Pgs,
                         language: "und".into(),
                         forced: false,
+                        qualifier: crate::disc::LabelQualifier::None,
                         codec_data: None,
                     })),
                     _ => None,
@@ -511,103 +508,6 @@ pub fn scan_streams(data: &[u8]) -> Option<Vec<crate::disc::Stream>> {
     }
 }
 
-// ============================================================
-// PTS scanning utilities (for duration detection)
-// ============================================================
-
-/// Find the first PTS for a given PID in BD-TS data.
-pub fn scan_first_pts(data: &[u8], target_pid: u16) -> Option<i64> {
-    let mut offset = 0;
-    while offset + BD_TS_PACKET_SIZE <= data.len() {
-        if data[offset + 4] != SYNC_BYTE {
-            offset += 1;
-            continue;
-        }
-        let pid = (((data[offset + 5] & 0x1F) as u16) << 8) | data[offset + 6] as u16;
-        let pusi = data[offset + 5] & 0x40 != 0;
-        if pid == target_pid && pusi {
-            let ts = &data[offset + 4..offset + BD_TS_PACKET_SIZE];
-            let afc = (ts[3] >> 4) & 0x03;
-            let payload_start = if afc == 3 { 5 + ts[4] as usize } else { 4 };
-            if payload_start < TS_PACKET_SIZE {
-                let payload = &ts[payload_start..];
-                if payload.len() >= 14 && payload[0] == 0 && payload[1] == 0 && payload[2] == 1 {
-                    let pts_dts_flags = (payload[7] >> 6) & 0x03;
-                    if pts_dts_flags >= 2 {
-                        return parse_timestamp(&payload[9..14]);
-                    }
-                }
-            }
-        }
-        offset += BD_TS_PACKET_SIZE;
-    }
-    None
-}
-
-/// Find the last PTS for a given PID in BD-TS data.
-pub fn scan_last_pts(data: &[u8], target_pid: u16) -> Option<i64> {
-    let mut last_pts = None;
-    let mut offset = 0;
-    while offset + BD_TS_PACKET_SIZE <= data.len() {
-        if data[offset + 4] != SYNC_BYTE {
-            offset += 1;
-            continue;
-        }
-        let pid = (((data[offset + 5] & 0x1F) as u16) << 8) | data[offset + 6] as u16;
-        let pusi = data[offset + 5] & 0x40 != 0;
-        if pid == target_pid && pusi {
-            let ts = &data[offset + 4..offset + BD_TS_PACKET_SIZE];
-            let afc = (ts[3] >> 4) & 0x03;
-            let payload_start = if afc == 3 { 5 + ts[4] as usize } else { 4 };
-            if payload_start < TS_PACKET_SIZE {
-                let payload = &ts[payload_start..];
-                if payload.len() >= 14 && payload[0] == 0 && payload[1] == 0 && payload[2] == 1 {
-                    let pts_dts_flags = (payload[7] >> 6) & 0x03;
-                    if pts_dts_flags >= 2 {
-                        last_pts = parse_timestamp(&payload[9..14]);
-                    }
-                }
-            }
-        }
-        offset += BD_TS_PACKET_SIZE;
-    }
-    last_pts
-}
-
-/// Scan an m2ts file for duration by reading first and last PTS.
-/// Returns duration in seconds, or None if PTS cannot be found.
-/// The reader position is restored after scanning.
-pub fn scan_duration<R: std::io::Read + std::io::Seek>(r: &mut R, video_pid: u16) -> Option<f64> {
-    use std::io::SeekFrom;
-
-    let start_pos = r.stream_position().ok()?;
-
-    // Read first 1MB for first PTS
-    let mut head_buf = vec![0u8; SCAN_HEAD_SIZE];
-    r.seek(SeekFrom::Start(0)).ok()?;
-    let head_n = r.read(&mut head_buf).ok()?;
-    let first_pts = scan_first_pts(&head_buf[..head_n], video_pid)?;
-
-    // Read last 2MB for last PTS (aligned to 192-byte boundary)
-    let file_size = r.seek(SeekFrom::End(0)).ok()?;
-    let tail_size: u64 = SCAN_TAIL_SIZE as u64;
-    let raw_pos = file_size.saturating_sub(tail_size);
-    let seek_pos = (raw_pos / BD_TS_PACKET_SIZE as u64) * BD_TS_PACKET_SIZE as u64;
-    r.seek(SeekFrom::Start(seek_pos)).ok()?;
-    let mut tail_buf = vec![0u8; tail_size as usize];
-    let tail_n = r.read(&mut tail_buf).ok()?;
-    let last_pts = scan_last_pts(&tail_buf[..tail_n], video_pid)?;
-
-    // Restore reader position
-    let _ = r.seek(SeekFrom::Start(start_pos));
-
-    if last_pts > first_pts {
-        Some((last_pts - first_pts) as f64 / 90000.0)
-    } else {
-        None
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

src/mux/tsmux.rs

@@ -15,6 +15,7 @@ pub struct TsMuxer<W: Write> {
     continuity: Vec<u8>,                  // per-PID continuity counter (0-15)
     codec_privates: Vec<Option<Vec<u8>>>, // per-track codec_private (for video parameter sets)
     params_written: Vec<bool>,            // per-track: have we written parameter sets?
+    base_pts_ns: Option<i64>,
 }
 
 impl<W: Write> TsMuxer<W> {
@@ -26,6 +27,7 @@ impl<W: Write> TsMuxer<W> {
             continuity: vec![0u8; n],
             codec_privates: vec![None; n],
             params_written: vec![false; n],
+            base_pts_ns: None,
         }
     }
 
@@ -44,6 +46,9 @@ impl<W: Write> TsMuxer<W> {
         if track >= self.pids.len() {
             return Ok(()); // unknown track, skip
         }
+        let base = *self.base_pts_ns.get_or_insert(pts_ns);
+        let pts_ns = pts_ns - base;
+
         let pid = self.pids[track];
         let is_video = (0x1011..=0x101F).contains(&pid);
 
@@ -222,11 +227,7 @@ fn hvcc_to_annex_b(hvcc: &[u8]) -> Option<Vec<u8>> {
         }
     }
 
-    if out.is_empty() {
-        None
-    } else {
-        Some(out)
-    }
+    if out.is_empty() { None } else { Some(out) }
 }
 
 /// Convert length-prefixed NALUs (4-byte BE length + NAL) to Annex B

src/mux/tsreader.rs

@@ -1,115 +0,0 @@
-//! TsDemuxReader — reads from any source, demuxes BD-TS, produces PES frames.
-//!
-//! Wraps any Read source with a TsDemuxer + CodecParsers.
-//! One implementation used by M2TS, Network, Stdio, and any other BD-TS input.
-
-use super::codec::{self, CodecParser};
-use super::ts::TsDemuxer;
-use crate::disc::Stream as DiscStream;
-use crate::pes::PesFrame;
-use std::collections::VecDeque;
-use std::io::{self, Read};
-
-const READ_BUF_SIZE: usize = 192 * 1024; // 1024 BD-TS packets
-
-/// Generic BD-TS → PES frame reader.
-pub struct TsDemuxReader<R: Read> {
-    reader: R,
-    demuxer: TsDemuxer,
-    parsers: Vec<(u16, Box<dyn CodecParser>)>,
-    pid_to_track: Vec<(u16, usize)>,
-    pending: VecDeque<PesFrame>,
-    buf: Vec<u8>,
-    eof: bool,
-}
-
-impl<R: Read> TsDemuxReader<R> {
-    /// Create from a reader and stream metadata.
-    pub fn new(reader: R, streams: &[DiscStream]) -> Self {
-        let mut pids = Vec::new();
-        let mut parsers: Vec<(u16, Box<dyn CodecParser>)> = Vec::new();
-        let mut pid_to_track = Vec::new();
-        for (i, s) in streams.iter().enumerate() {
-            let (pid, c) = match s {
-                DiscStream::Video(v) => (v.pid, v.codec),
-                DiscStream::Audio(a) => (a.pid, a.codec),
-                DiscStream::Subtitle(s) => (s.pid, s.codec),
-            };
-            pids.push(pid);
-            pid_to_track.push((pid, i));
-            parsers.push((pid, codec::parser_for_codec(c)));
-        }
-
-        Self {
-            reader,
-            demuxer: TsDemuxer::new(&pids),
-            parsers,
-            pid_to_track,
-            pending: VecDeque::new(),
-            buf: vec![0u8; READ_BUF_SIZE],
-            eof: false,
-        }
-    }
-
-    /// Get the next PES frame. Returns None at EOF.
-    pub fn next_frame(&mut self) -> io::Result<Option<PesFrame>> {
-        if let Some(frame) = self.pending.pop_front() {
-            return Ok(Some(frame));
-        }
-        if self.eof {
-            return Ok(None);
-        }
-
-        loop {
-            let n = self.reader.read(&mut self.buf)?;
-            if n == 0 {
-                self.eof = true;
-                return Ok(None);
-            }
-
-            let packets = self.demuxer.feed(&self.buf[..n]);
-            for pes in &packets {
-                if let Some((_, track)) = self.pid_to_track.iter().find(|(pid, _)| *pid == pes.pid)
-                {
-                    if let Some((_, parser)) =
-                        self.parsers.iter_mut().find(|(pid, _)| *pid == pes.pid)
-                    {
-                        for frame in parser.parse(pes) {
-                            self.pending
-                                .push_back(PesFrame::from_codec_frame(*track, frame));
-                        }
-                    }
-                }
-            }
-
-            if let Some(frame) = self.pending.pop_front() {
-                return Ok(Some(frame));
-            }
-        }
-    }
-
-    /// Codec private data for a track.
-    pub fn codec_private(&self, track: usize) -> Option<Vec<u8>> {
-        let pid = self
-            .pid_to_track
-            .iter()
-            .find(|(_, idx)| *idx == track)
-            .map(|(pid, _)| *pid)?;
-        self.parsers
-            .iter()
-            .find(|(p, _)| *p == pid)
-            .and_then(|(_, parser)| parser.codec_private())
-    }
-
-    /// True when all primary video tracks have codec_private.
-    pub fn headers_ready(&self, streams: &[DiscStream]) -> bool {
-        for (idx, s) in streams.iter().enumerate() {
-            if let DiscStream::Video(v) = s {
-                if !v.secondary && self.codec_private(idx).is_none() {
-                    return false;
-                }
-            }
-        }
-        true
-    }
-}

src/pes.rs

@@ -78,26 +78,63 @@ impl PesFrame {
     }
 }
 
-/// A stream. Read from it or write to it. Not both.
+/// A PES frame source or sink. Each implementor is **either** read-only or
+/// write-only — never both.
+///
+/// Implementors fall into two camps:
+///
+/// - **Read sources**: `DiscStream` (drive or ISO), `M2tsStream` (when
+///   constructed from an existing file), `MkvStream` (demux), `NetworkStream`
+///   (TCP listener), `StdioStream::input()`. These return frames from
+///   `read()` and surface `StreamWriteOnly` (E9001) from `write()`.
+/// - **Write sinks**: `MkvStream::create`, `M2tsStream::create`,
+///   `NetworkStream::connect`, `StdioStream::output()`, `NullStream`.
+///   These accept frames in `write()` and surface `StreamReadOnly` (E9000)
+///   from `read()`. Always call `finish()` when done — that's where MKV
+///   writes its `Cues` index and `M2tsStream` flushes the TS muxer.
+///
+/// Direction is established at construction; mixing produces an error code,
+/// not a panic. Most consumers don't construct streams directly — call
+/// `mux::input(url, opts)` / `mux::output(url, title)` and let URL parsing
+/// pick the right type.
+///
+/// `info()` returns the stream's `DiscTitle` metadata (track list, codec
+/// info, duration). For sources it's parsed from the input; for sinks it's
+/// the metadata supplied at creation. Stable across all reads.
+///
+/// `codec_private(track)` exposes per-track initialization data
+/// (H.264 SPS/PPS, HEVC VPS/SPS/PPS, AC-3 fscod, etc.) that some output
+/// formats need before any frame can be written. `headers_ready()` returns
+/// false until enough input frames have been seen to populate every video
+/// track's codec-private blob — callers buffer frames they read until
+/// `headers_ready()` returns true.
 pub trait Stream {
-    /// Read the next frame. Returns None at end of stream.
+    /// Read the next frame, or `Ok(None)` at end of stream. Returns
+    /// `StreamWriteOnly` (E9001) on a write-only sink.
     fn read(&mut self) -> std::io::Result<Option<PesFrame>>;
 
-    /// Write a frame.
+    /// Write a frame to the sink. Returns `StreamReadOnly` (E9000) on a
+    /// read-only source.
     fn write(&mut self, frame: &PesFrame) -> std::io::Result<()>;
 
-    /// Finalize (flush, write index, close).
+    /// Finalize the stream: flush buffered frames, write any container
+    /// index (MKV `Cues`), close the underlying file/socket. Idempotent
+    /// for read-only streams (no-op).
     fn finish(&mut self) -> std::io::Result<()>;
 
-    /// Stream metadata.
+    /// Stream metadata. Stable across reads — implementors must return a
+    /// consistent reference for the lifetime of the stream.
     fn info(&self) -> &crate::disc::DiscTitle;
 
-    /// Codec initialization data for a track (SPS/PPS, etc).
+    /// Codec initialization data for a track (SPS/PPS, AC-3 fscod, etc.).
+    /// `None` for tracks that don't need codec_private (raw passthrough).
     fn codec_private(&self, _track: usize) -> Option<Vec<u8>> {
         None
     }
 
-    /// True when codec_private is available for all video tracks.
+    /// True when `codec_private` is available for every video track —
+    /// callers buffer input frames until this flips, since some output
+    /// formats (MKV) can't write frames without codec init data.
     fn headers_ready(&self) -> bool {
         true
     }

src/progress.rs

@@ -0,0 +1,70 @@
+//! Pipeline-progress reporting for the rip pipeline.
+//!
+//! v0.13.16 architecture rule: ONE progress signal type. Every long-running
+//! pipeline operation (`Disc::copy`, `Disc::patch`, mux) emits the same
+//! `PassProgress` shape via the `Progress` trait. Consumers (autorip) compute
+//! a single `PipelineStats` derived view and never reach into per-pass
+//! internals.
+//!
+//! Why this matters: pre-0.13.16 the API leaked `pos`, `bytes_good`,
+//! `work_done`, `bytes_pending`, `Finished/NonTrimmed` mapfile semantics —
+//! and consumers reinvented the math each time they wanted a percentage.
+//! UIs ended up reading one source while server-side computed from another,
+//! producing wrong percentages without anyone noticing.
+
+/// Identifies which pipeline phase the progress event belongs to.
+///
+/// Consumers can render a phase-specific label (e.g. "Sweep", "Trim
+/// (reverse)", "Scrape", "Mux") or just use a generic "Pass N" label.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PassKind {
+    /// `Disc::copy` — initial sweep across the entire disc.
+    Sweep,
+    /// `Disc::patch` retry pass with `block_sectors >= 2`. `reverse=true`
+    /// means walking bad ranges from highest to lowest LBA.
+    Trim { reverse: bool },
+    /// `Disc::patch` final pass at 1 sector per block.
+    Scrape { reverse: bool },
+    /// Demux ISO → output (MKV / M2TS / network). Single phase that runs
+    /// after all rip passes complete.
+    Mux,
+}
+
+/// One progress sample from a pipeline phase.
+///
+/// `work_done / work_total` is the per-pass percentage — always 0..=100%
+/// regardless of which kind of pass is running. `bytes_good_total` is the
+/// cumulative count of confirmed-clean bytes across the whole rip; useful
+/// for the "data recovered" stat the user sees.
+#[derive(Debug, Clone, Copy)]
+pub struct PassProgress {
+    pub kind: PassKind,
+    /// Bytes processed in this pass so far. Monotonically non-decreasing.
+    pub work_done: u64,
+    /// Total bytes this pass will process. Constant for the duration of
+    /// the pass.
+    pub work_total: u64,
+    /// Cumulative bytes confirmed clean (`Finished` mapfile state) across
+    /// every pass run on this rip. Doesn't change across pass boundaries.
+    pub bytes_good_total: u64,
+    /// Total disc capacity in bytes. Constant.
+    pub bytes_total_disc: u64,
+}
+
+/// A consumer of pipeline progress events. Library code calls
+/// `Progress::report` once per inner-loop iteration (throttling is the
+/// consumer's job — `report` is cheap; the library doesn't gate it).
+///
+/// No `Send`/`Sync` bound — `report` is always called from the same thread
+/// running the rip pipeline, so closures with non-`Sync` captures (e.g.
+/// `RefCell<PassProgressState>`) work directly. Blanket impl below lets
+/// callers pass closures without explicit struct types.
+pub trait Progress {
+    fn report(&self, p: &PassProgress);
+}
+
+impl<F: Fn(&PassProgress)> Progress for F {
+    fn report(&self, p: &PassProgress) {
+        (self)(p)
+    }
+}

src/scsi/linux.rs

@@ -1,16 +1,20 @@
-//! Linux SCSI transport via SG_IO ioctl.
+//! Linux SCSI transport via async sg write/poll/read.
+//!
+//! Uses the sg driver's asynchronous interface instead of the blocking
+//! SG_IO ioctl. Commands are submitted via write(), waited on via
+//! poll() with a hard timeout, and completed via read(). If poll()
+//! times out, the fd is abandoned (closed in a background thread) and
+//! a fresh fd is opened. This gives us true user-controlled timeouts
+//! that the kernel's USB error recovery cannot override.
 
 use super::{DataDirection, ScsiResult, ScsiTransport};
 use crate::error::{Error, Result};
 use std::path::Path;
 
 const SG_IO: u32 = 0x2285;
-const SG_SCSI_RESET: u32 = 0x2284;
-const SG_SCSI_RESET_DEVICE: i32 = 1;
 const SG_DXFER_NONE: i32 = -1;
 const SG_DXFER_TO_DEV: i32 = -2;
 const SG_DXFER_FROM_DEV: i32 = -3;
-const SG_FLAG_DIRECT_IO: u32 = 1;
 const SG_FLAG_Q_AT_HEAD: u32 = 0x10;
 
 #[repr(C)]
@@ -49,8 +53,19 @@ const _: () = assert!(std::mem::size_of::<sg_io_hdr>() == 64);
 
 pub struct SgIoTransport {
     fd: i32,
+    device_path: std::path::PathBuf,
+    /// Background-recovered fd. After a poll timeout `execute()` spawns a
+    /// thread that closes `self.fd` and opens a fresh fd; the new fd is
+    /// stored here. The next call to `execute()` swaps it into `self.fd`.
+    /// `-1` means no recovery is ready (or the recovery open failed). See
+    /// RIP_DESIGN.md §7 for the design rationale.
+    fd_recovery: std::sync::Arc<std::sync::atomic::AtomicI32>,
 }
 
+// SgIoTransport's contained types (i32, PathBuf, Arc<AtomicI32>) are all
+// Send; the auto-derived Send is intentional. Sync is NOT — callers must
+// hold &mut for execute(), which the trait object dispatch enforces.
+
 impl SgIoTransport {
     /// Open a SCSI device for use. Resets the drive first to ensure
     /// a known good state, then opens a fresh fd for commands.
@@ -61,103 +76,73 @@ impl SgIoTransport {
         let fd = unsafe {
             libc::open(
                 c_path.as_ptr() as *const libc::c_char,
-                libc::O_RDWR | libc::O_NONBLOCK,
+                libc::O_RDWR | libc::O_NONBLOCK | libc::O_CLOEXEC,
             )
         };
         if fd < 0 {
             return Self::open_error(&device);
         }
-        Ok(SgIoTransport { fd })
+        Ok(SgIoTransport {
+            fd,
+            device_path: device,
+            fd_recovery: std::sync::Arc::new(std::sync::atomic::AtomicI32::new(-1)),
+        })
     }
 
-    /// Reset the drive to a known good state — equivalent to unplug/replug.
-    /// After reset, the drive is clean and no fd is held open.
+    /// Clean up kernel SG_IO state and unlock the tray. NOT a hardware
+    /// reset — purely software cleanup before this process opens the
+    /// device for real work.
     ///
-    /// ## Why each step exists
+    /// When a previous process is killed (SIGKILL) mid-SG_IO, the kernel
+    /// may hold queued commands against the dead fd, and `Drop` never
+    /// ran so the tray may still be locked via PREVENT MEDIUM REMOVAL.
+    /// This routine handles both: open + close flushes the kernel SG
+    /// queue (sg_release cancels commands tied to the fd), the 2 s sleep
+    /// gives the kernel time to finish that cleanup, then a fresh fd
+    /// sends ALLOW MEDIUM REMOVAL to clear any stale tray lock.
     ///
-    /// When a process is killed (SIGKILL/kill -9) mid-SG_IO ioctl, two things
-    /// go wrong: (1) the kernel's SG driver may have stale pending commands
-    /// queued for the dead process's fd, and (2) the drive firmware may still
-    /// be mid-operation (seeking, reading, processing a vendor command).
-    ///
-    /// A new process opening the same /dev/sg* device gets a fresh fd, but the
-    /// kernel doesn't automatically abort the dead process's commands — the
-    /// drive can appear hung on the first SCSI command.
-    ///
-    /// Additionally, killed processes skip Drop, so the tray may be locked
-    /// via PREVENT MEDIUM REMOVAL with no process alive to unlock it.
-    ///
-    /// ## Sequence
-    ///
-    /// 1. **open** — allocates kernel SG state for this fd
-    /// 2. **close** — triggers kernel cleanup: aborts any pending SG_IO
-    ///    commands associated with this fd. The key operation —
-    ///    the kernel's sg_release() cancels queued commands.
-    /// 3. **sleep 2s** — the drive firmware needs time to finish/abort whatever
-    ///    it was doing when the previous process died. Without
-    ///    this, the next command may block on drive-internal state.
-    /// 4. **open** — fresh fd with no stale commands in the kernel queue
-    /// 5. **unlock** — ALLOW MEDIUM REMOVAL (CDB 0x1E, prevent=0). Clears
-    ///    any tray lock left by a killed process that never
-    ///    ran its Drop/cleanup.
-    /// 6. **TUR** — TEST UNIT READY (CDB 0x00) with 3s timeout. If the
-    ///    drive responds, it's in a good state.
-    /// 7. **escalate** — if TUR fails:
-    ///    - SG_SCSI_RESET (device level) — kernel sends a SCSI
-    ///      bus reset to the device, clearing all firmware state.
-    ///    - STOP + START UNIT (CDB 0x1B) — power-cycles the
-    ///      drive's logical unit, like pressing the eject button
-    ///      and reinserting.
-    /// 8. **close** — release the fd. Drive is clean, nobody holds it.
+    /// We do NOT verify the drive with TUR or escalate to SG_SCSI_RESET /
+    /// STOP+START UNIT. Both escalations were tried in 0.13.0–0.13.5
+    /// against the LG BU40N (Initio USB-SATA bridge); both failed to
+    /// recover wedged drives and made the wedge worse — see
+    /// (internal)/postmortems/2026-04-25-bu40n-wedge-recovery.md.
+    /// If the drive is genuinely unresponsive, the next workload command
+    /// fails naturally and the caller surfaces a "physical reconnect
+    /// required" prompt. Software has no path back from a wedged Initio
+    /// bridge — only physical replug clears it.
     pub fn reset(device: &Path) -> Result<()> {
         let c_path = Self::to_c_path(device);
 
-        // Step 1-2: open + close — flush stale kernel SG_IO state
+        // open + close — make the kernel cancel any SG_IO commands queued
+        // against a previous fd that didn't close cleanly.
         let probe_fd = unsafe {
             libc::open(
                 c_path.as_ptr() as *const libc::c_char,
-                libc::O_RDWR | libc::O_NONBLOCK,
+                libc::O_RDWR | libc::O_NONBLOCK | libc::O_CLOEXEC,
             )
         };
         if probe_fd >= 0 {
             unsafe { libc::close(probe_fd) };
         }
 
-        // Step 3: let drive settle
+        // Let the kernel finish that cancellation before we reopen.
         std::thread::sleep(std::time::Duration::from_secs(2));
 
-        // Step 4: open clean fd
+        // Fresh fd just to send the unlock command, then close.
         let fd = unsafe {
             libc::open(
                 c_path.as_ptr() as *const libc::c_char,
-                libc::O_RDWR | libc::O_NONBLOCK,
+                libc::O_RDWR | libc::O_NONBLOCK | libc::O_CLOEXEC,
             )
         };
         if fd < 0 {
             return Self::open_error(device);
         }
 
-        // Step 5: unlock tray
+        // ALLOW MEDIUM REMOVAL — clear any tray lock left by a killed
+        // process whose Drop never ran. Best-effort; ignore result.
         let _ = Self::raw_command(fd, &[0x1E, 0, 0, 0, 0, 0], 3_000);
 
-        // Step 6: TUR — if drive responds, we're done
-        if Self::raw_command(fd, &[0, 0, 0, 0, 0, 0], 3_000).is_err() {
-            // Step 7: escalate — SG_SCSI_RESET
-            let mut reset_type: i32 = SG_SCSI_RESET_DEVICE;
-            unsafe { libc::ioctl(fd, SG_SCSI_RESET as _, &mut reset_type) };
-            std::thread::sleep(std::time::Duration::from_secs(3));
-
-            if Self::raw_command(fd, &[0, 0, 0, 0, 0, 0], 3_000).is_err() {
-                // STOP + START
-                let _ = Self::raw_command(fd, &[0x1B, 0, 0, 0, 0x00, 0], 3_000);
-                std::thread::sleep(std::time::Duration::from_secs(1));
-                let _ = Self::raw_command(fd, &[0x1B, 0, 0, 0, 0x01, 0], 3_000);
-                std::thread::sleep(std::time::Duration::from_secs(3));
-                let _ = Self::raw_command(fd, &[0, 0, 0, 0, 0, 0], 3_000);
-            }
-        }
-
-        // Step 8: close — drive is clean
         unsafe { libc::close(fd) };
         Ok(())
     }
@@ -166,10 +151,7 @@ impl SgIoTransport {
         let err = std::io::Error::last_os_error();
         Err(if err.kind() == std::io::ErrorKind::PermissionDenied {
             Error::DevicePermission {
-                path: format!(
-                    "{}: permission denied (try running as root)",
-                    device.display()
-                ),
+                path: device.display().to_string(),
             }
         } else {
             Error::DeviceNotFound {
@@ -179,7 +161,8 @@ impl SgIoTransport {
     }
 
     /// Send a raw SCSI command on an fd. Used by reset() before the
-    /// transport is constructed.
+    /// transport is constructed. Uses synchronous SG_IO — fine for
+    /// short commands (TUR, PREVENT MEDIUM REMOVAL, START/STOP).
     fn raw_command(fd: i32, cdb: &[u8], timeout_ms: u32) -> std::result::Result<(), ()> {
         let mut sense = [0u8; 32];
         let mut hdr: sg_io_hdr = unsafe { std::mem::zeroed() };
@@ -239,13 +222,37 @@ impl SgIoTransport {
 
 impl Drop for SgIoTransport {
     fn drop(&mut self) {
-        // Unlock tray before closing — don't leave it locked
-        let _ = Self::raw_command(self.fd, &[0x1E, 0, 0, 0, 0, 0], 3_000);
-        unsafe { libc::close(self.fd) };
+        if self.fd >= 0 {
+            // Unlock tray before closing — don't leave it locked
+            let _ = Self::raw_command(self.fd, &[0x1E, 0, 0, 0, 0, 0], 3_000);
+            unsafe { libc::close(self.fd) };
+        }
+        // Drain any background-recovered fd so it doesn't leak.
+        let recovered = self
+            .fd_recovery
+            .swap(-1, std::sync::atomic::Ordering::Acquire);
+        if recovered >= 0 {
+            unsafe { libc::close(recovered) };
+        }
     }
 }
 
 impl ScsiTransport for SgIoTransport {
+    /// Execute a SCSI command with an enforceable timeout.
+    ///
+    /// Uses the sg driver's async write/poll/read interface:
+    /// 1. write() submits the command — returns immediately
+    /// 2. poll() waits for completion — respects our timeout exactly
+    /// 3. read() retrieves the result — copies data to caller's buffer
+    ///
+    /// If poll() times out, the pending command is abandoned: the old fd
+    /// is closed in a background thread (may block while kernel finishes
+    /// the USB transfer) and a fresh fd is opened. The caller sees a
+    /// normal SCSI error and can retry.
+    ///
+    /// Without SG_FLAG_DIRECT_IO, the kernel uses internal buffers for
+    /// DMA and copies to userspace during read(). On timeout (no read),
+    /// the caller's buffer is untouched — safe to return immediately.
     fn execute(
         &mut self,
         cdb: &[u8],
@@ -253,6 +260,47 @@ impl ScsiTransport for SgIoTransport {
         data: &mut [u8],
         timeout_ms: u32,
     ) -> Result<ScsiResult> {
+        let exec_t0 = std::time::Instant::now();
+        let opcode = cdb[0];
+        tracing::trace!(
+            target: "freemkv::scsi",
+            phase = "enter",
+            opcode = opcode,
+            timeout_ms,
+            data_len = data.len(),
+            fd = self.fd,
+            "SgIoTransport::execute"
+        );
+
+        // Recover from a prior timeout: if a background reopen produced a
+        // fresh fd, swap it in. If recovery is still pending (-1), the
+        // background thread hasn't finished — return DeviceNotFound and let
+        // the caller's retry loop come back later.
+        if self.fd < 0 {
+            let recovered = self
+                .fd_recovery
+                .swap(-1, std::sync::atomic::Ordering::Acquire);
+            if recovered >= 0 {
+                tracing::trace!(
+                    target: "freemkv::scsi",
+                    phase = "recovery_swap_ok",
+                    new_fd = recovered,
+                    "fd_recovery delivered fresh fd"
+                );
+                self.fd = recovered;
+            } else {
+                tracing::trace!(
+                    target: "freemkv::scsi",
+                    phase = "recovery_pending",
+                    elapsed_us = exec_t0.elapsed().as_micros() as u64,
+                    "fd_recovery still pending → DeviceNotFound"
+                );
+                return Err(Error::DeviceNotFound {
+                    path: self.device_path.display().to_string(),
+                });
+            }
+        }
+
         let mut sense = [0u8; 32];
 
         let dxfer_direction = match direction {
@@ -281,18 +329,153 @@ impl ScsiTransport for SgIoTransport {
         hdr.cmdp = cdb.as_ptr();
         hdr.sbp = sense.as_mut_ptr();
         hdr.timeout = timeout_ms;
-        if dxfer_direction == SG_DXFER_FROM_DEV
-            && data.len() >= 4096
-            && (data.as_ptr() as usize) % 4096 == 0
-        {
-            hdr.flags = SG_FLAG_DIRECT_IO | SG_FLAG_Q_AT_HEAD;
-        } else {
-            hdr.flags = SG_FLAG_Q_AT_HEAD;
+        hdr.flags = SG_FLAG_Q_AT_HEAD;
+
+        // Submit command asynchronously via write()
+        let hdr_size = std::mem::size_of::<sg_io_hdr>();
+        let write_t0 = std::time::Instant::now();
+        let wr = unsafe {
+            libc::write(
+                self.fd,
+                &hdr as *const sg_io_hdr as *const libc::c_void,
+                hdr_size,
+            )
+        };
+        let write_elapsed_us = write_t0.elapsed().as_micros() as u64;
+        if wr < 0 {
+            let errno = std::io::Error::last_os_error();
+            tracing::trace!(
+                target: "freemkv::scsi",
+                phase = "write_err",
+                opcode = opcode,
+                errno = errno.raw_os_error().unwrap_or(0),
+                write_elapsed_us,
+                "sg write() returned <0"
+            );
+            return Err(Error::IoError { source: errno });
+        }
+        tracing::trace!(
+            target: "freemkv::scsi",
+            phase = "write_ok",
+            opcode = opcode,
+            wr,
+            write_elapsed_us,
+            "sg write() submitted"
+        );
+
+        // Wait for completion with enforceable timeout.
+        // Retry on EINTR (signal interrupted poll) with remaining time.
+        let poll_t0 = std::time::Instant::now();
+        let deadline = poll_t0 + std::time::Duration::from_millis(timeout_ms as u64);
+        let pr = loop {
+            let remaining = deadline
+                .saturating_duration_since(std::time::Instant::now())
+                .as_millis() as i32;
+            if remaining <= 0 {
+                break 0; // expired
+            }
+            let mut pfd = libc::pollfd {
+                fd: self.fd,
+                events: libc::POLLIN,
+                revents: 0,
+            };
+            let ret = unsafe { libc::poll(&mut pfd, 1, remaining) };
+            if ret >= 0 || std::io::Error::last_os_error().kind() != std::io::ErrorKind::Interrupted
+            {
+                break ret;
+            }
+        };
+        let poll_elapsed_ms = poll_t0.elapsed().as_millis() as u64;
+        tracing::trace!(
+            target: "freemkv::scsi",
+            phase = "poll_done",
+            opcode = opcode,
+            pr,
+            poll_elapsed_ms,
+            timeout_ms,
+            "poll() returned"
+        );
+
+        if pr <= 0 {
+            // Timeout (0) or fatal poll error (-1). Command is still pending
+            // in the kernel. Per RIP_DESIGN.md §4(b)/§7: close + reopen run
+            // in a background thread so the main thread is never blocked
+            // beyond the poll() budget. The recovered fd is published to
+            // `fd_recovery`; the next call to execute() picks it up.
+            let old_fd = self.fd;
+            self.fd = -1;
+            let c_path = Self::to_c_path(&self.device_path);
+            let recovery = self.fd_recovery.clone();
+            tracing::trace!(
+                target: "freemkv::scsi",
+                phase = "timeout_spawn_recovery",
+                opcode = opcode,
+                old_fd,
+                exec_elapsed_ms = exec_t0.elapsed().as_millis() as u64,
+                "poll timeout — spawning bg close+open"
+            );
+            std::thread::spawn(move || {
+                // Close blocks until the kernel finishes/aborts the
+                // abandoned command. Then we open a fresh fd. Both happen
+                // off the main thread.
+                let close_t0 = std::time::Instant::now();
+                unsafe { libc::close(old_fd) };
+                let close_ms = close_t0.elapsed().as_millis() as u64;
+                let open_t0 = std::time::Instant::now();
+                let new_fd = unsafe {
+                    libc::open(
+                        c_path.as_ptr() as *const libc::c_char,
+                        libc::O_RDWR | libc::O_NONBLOCK | libc::O_CLOEXEC,
+                    )
+                };
+                let open_ms = open_t0.elapsed().as_millis() as u64;
+                tracing::trace!(
+                    target: "freemkv::scsi",
+                    phase = "bg_recovery_done",
+                    old_fd,
+                    new_fd,
+                    close_ms,
+                    open_ms,
+                    "bg recovery thread completed close+open"
+                );
+                if new_fd >= 0 {
+                    let prev = recovery.swap(new_fd, std::sync::atomic::Ordering::Release);
+                    if prev >= 0 {
+                        // Stale recovery fd from a prior unclaimed attempt;
+                        // close it so it doesn't leak.
+                        unsafe { libc::close(prev) };
+                    }
+                } else {
+                    recovery.store(-1, std::sync::atomic::Ordering::Release);
+                }
+            });
+
+            return Err(Error::ScsiError {
+                opcode: cdb[0],
+                status: 0xFF,
+                sense_key: 0,
+            });
         }
 
-        let ret = unsafe { libc::ioctl(self.fd, SG_IO as _, &mut hdr as *mut sg_io_hdr) };
-
-        if ret < 0 {
+        // Read response — copies data from kernel buffer to caller's buffer
+        let read_t0 = std::time::Instant::now();
+        let rd = unsafe {
+            libc::read(
+                self.fd,
+                &mut hdr as *mut sg_io_hdr as *mut libc::c_void,
+                hdr_size,
+            )
+        };
+        let read_elapsed_us = read_t0.elapsed().as_micros() as u64;
+        if rd < 0 {
+            tracing::trace!(
+                target: "freemkv::scsi",
+                phase = "read_err",
+                opcode = opcode,
+                read_elapsed_us,
+                exec_elapsed_ms = exec_t0.elapsed().as_millis() as u64,
+                "sg read() returned <0"
+            );
             return Err(Error::IoError {
                 source: std::io::Error::last_os_error(),
             });
@@ -301,11 +484,27 @@ impl ScsiTransport for SgIoTransport {
         let bytes_transferred = (data.len() as i32).saturating_sub(hdr.resid).max(0) as usize;
 
         if hdr.status != 0 {
-            let sense_key = if hdr.sb_len_wr > 2 {
-                sense[2] & 0x0F
+            let sense_key = if hdr.sb_len_wr >= 3 {
+                let response_code = sense[0] & 0x7F;
+                if response_code == 0x72 || response_code == 0x73 {
+                    // Descriptor format sense: sense key at byte 1
+                    sense[1] & 0x0F
+                } else {
+                    // Fixed format sense (0x70/0x71): sense key at byte 2
+                    sense[2] & 0x0F
+                }
             } else {
                 0
             };
+            tracing::trace!(
+                target: "freemkv::scsi",
+                phase = "scsi_err",
+                opcode = opcode,
+                status = hdr.status,
+                sense_key,
+                exec_elapsed_ms = exec_t0.elapsed().as_millis() as u64,
+                "SCSI status non-zero"
+            );
             return Err(Error::ScsiError {
                 opcode: cdb[0],
                 status: hdr.status,
@@ -313,6 +512,14 @@ impl ScsiTransport for SgIoTransport {
             });
         }
 
+        tracing::trace!(
+            target: "freemkv::scsi",
+            phase = "ok",
+            opcode = opcode,
+            bytes_transferred,
+            exec_elapsed_ms = exec_t0.elapsed().as_millis() as u64,
+            "execute() success"
+        );
         Ok(ScsiResult {
             status: hdr.status,
             bytes_transferred,
@@ -320,3 +527,187 @@ impl ScsiTransport for SgIoTransport {
         })
     }
 }
+
+// ── Lightweight discovery + presence (Linux) ────────────────────────────────
+//
+// `list_drives` walks `/sys/class/scsi_generic/`, filters to type-5 (CD/DVD/BD),
+// and runs one INQUIRY each for vendor/model/firmware. Falls back to a
+// `/dev/sg0..15` probe when sysfs is unreadable (minimal containers).
+//
+// `drive_has_disc` issues a single TEST UNIT READY. On the wedge signature
+// (kernel returns status `0xff` with no sense) it escalates: SCSI bus reset
+// → if still wedged → USB device reset (`USBDEVFS_RESET`) → retry TUR.
+// Callers never see the escalation; if it fails too, surface
+// `DeviceResetFailed` so the caller can back off.
+
+/// SCSI peripheral type 5 = "CD-ROM device" (covers DVD, BD-ROM, BD-RE, etc.).
+/// Stored in `/sys/class/scsi_generic/sgN/device/type` as ASCII decimal.
+const SCSI_TYPE_OPTICAL: &str = "5";
+
+/// SCSI sense key 2 = "NOT READY". Sub-codes distinguish "medium not present"
+/// (no disc) from other not-ready states (loading, etc.); for poll-loop
+/// purposes any sense-key 2 means "no disc to act on".
+const SENSE_KEY_NOT_READY: u8 = 2;
+
+/// Maximum sg index probed in the fallback path when sysfs is unavailable.
+/// Linux assigns `/dev/sgN` sequentially per host adapter; 16 covers any
+/// realistic homelab (typical PERC + USB optical = ≤8 nodes).
+const SG_FALLBACK_MAX: u8 = 16;
+
+// SCSI INQUIRY field-offset constants previously lived here. They were
+// used by an in-process SCSI INQUIRY parse path that 0.13.6 retired in
+// favour of reading the kernel-cached sysfs identity (vendor/model/rev
+// under /sys/class/scsi_generic/sgN/device/). Removed to keep clippy
+// -D warnings clean.
+
+pub(super) fn list_drives() -> Vec<super::DriveInfo> {
+    let mut out = Vec::new();
+    let names = enumerate_sg_names();
+    for name in names {
+        let path = format!("/dev/{name}");
+        if !std::path::Path::new(&path).exists() {
+            continue;
+        }
+
+        // Read sysfs-cached identity first. The kernel runs its own INQUIRY
+        // at device probe time and stashes vendor/model/rev under
+        // `/sys/class/scsi_generic/sgN/device/`. Those values survive even
+        // when the drive firmware is wedged below the USB bridge (our own
+        // INQUIRY times out but sysfs still has the pre-wedge answer), so
+        // the UI always has a human-readable identity to show.
+        let (sysfs_vendor, sysfs_model, sysfs_firmware) = sysfs_identity(&name);
+
+        // INQUIRY-only probe — open transport, run INQUIRY, drop. No
+        // identify, no init, no firmware reset preamble's secondary
+        // commands beyond what `SgIoTransport::open` already does (one
+        // SCSI bus reset on the kernel SG fd, ~2 s).
+        let info = match SgIoTransport::open(std::path::Path::new(&path)) {
+            Ok(mut transport) => match super::inquiry(&mut transport) {
+                Ok(r) => super::DriveInfo {
+                    path: path.clone(),
+                    vendor: pick_identity(r.vendor_id, &sysfs_vendor),
+                    model: pick_identity(r.model, &sysfs_model),
+                    firmware: pick_identity(r.firmware, &sysfs_firmware),
+                },
+                Err(_) => super::DriveInfo {
+                    path: path.clone(),
+                    vendor: sysfs_vendor,
+                    model: sysfs_model,
+                    firmware: sysfs_firmware,
+                },
+            },
+            Err(_) => super::DriveInfo {
+                path: path.clone(),
+                vendor: sysfs_vendor,
+                model: sysfs_model,
+                firmware: sysfs_firmware,
+            },
+        };
+        out.push(info);
+    }
+    out
+}
+
+/// Prefer the live INQUIRY answer over the sysfs-cached one, but fall
+/// back to sysfs when the live answer is empty (wedge / bridge bug).
+fn pick_identity(live: String, sysfs: &str) -> String {
+    let trimmed = live.trim();
+    if trimmed.is_empty() {
+        sysfs.to_string()
+    } else {
+        live
+    }
+}
+
+/// Read the kernel's cached INQUIRY identity strings for `sgN` from
+/// `/sys/class/scsi_generic/sgN/device/{vendor,model,rev}`. Empty strings
+/// when sysfs is unavailable (minimal container, non-Linux filesystem).
+fn sysfs_identity(name: &str) -> (String, String, String) {
+    let read = |field: &str| -> String {
+        std::fs::read_to_string(format!("/sys/class/scsi_generic/{name}/device/{field}"))
+            .map(|s| s.trim().to_string())
+            .unwrap_or_default()
+    };
+    (read("vendor"), read("model"), read("rev"))
+}
+
+/// Enumerate `sg*` names via `/sys/class/scsi_generic/`, filtered to
+/// SCSI peripheral type 5 (optical). Falls back to a `sg0..15` probe
+/// when sysfs is unreadable. Returns names sorted lexically so caller
+/// iteration is deterministic.
+fn enumerate_sg_names() -> Vec<String> {
+    let mut names = Vec::new();
+    if let Ok(entries) = std::fs::read_dir("/sys/class/scsi_generic") {
+        for entry in entries.flatten() {
+            let name = entry.file_name().to_string_lossy().to_string();
+            if !name.starts_with("sg") {
+                continue;
+            }
+            let type_path = format!("/sys/class/scsi_generic/{name}/device/type");
+            match std::fs::read_to_string(&type_path) {
+                Ok(s) if s.trim() == SCSI_TYPE_OPTICAL => names.push(name),
+                Ok(_) => {}                 // not optical
+                Err(_) => names.push(name), // sysfs unreadable — let INQUIRY decide
+            }
+        }
+    } else {
+        // Sysfs missing — fall back to a brute-force probe. The INQUIRY
+        // step in `list_drives` filters non-optical responses naturally.
+        for i in 0..SG_FALLBACK_MAX {
+            let name = format!("sg{i}");
+            if std::path::Path::new(&format!("/dev/{name}")).exists() {
+                names.push(name);
+            }
+        }
+    }
+    names.sort();
+    names
+}
+
+/// `drive_has_disc` = single TEST UNIT READY. Any error (including our
+/// synthesised wedge signature, `ScsiError { status: 0xFF }`, when
+/// `execute()` times out) bubbles straight up to the caller.
+///
+/// ## No in-library wedge recovery — and why
+///
+/// Versions 0.13.1 – 0.13.3 layered `scsi::reset()` + `scsi::usb_reset()`
+/// (`USBDEVFS_RESET`) escalation inside `drive_has_disc`. Production
+/// testing on the LG BU40N USB BD-RE showed all three userspace recovery
+/// ladders succeed at the USB transport level (the kernel logs
+/// `usb 3-2: reset high-speed USB device`, the device re-authorises
+/// and re-attaches on a fresh `scsi_host`) **but the drive firmware
+/// below the USB bridge stays locked** — no LUN ever enumerates, TUR
+/// never succeeds, /dev/sg* never reappears. Physical power-cycle
+/// (unplug-replug or host reboot) is the only recovery.
+///
+/// Methods tried and discarded:
+///  - `SG_SCSI_RESET` (device-level SCSI bus reset)
+///  - `STOP UNIT` / `START UNIT` CDB pair
+///  - `USBDEVFS_RESET` ioctl on `/dev/bus/usb/BBB/DDD`
+///  - `/sys/bus/usb/devices/<port>/authorized` 0→1 toggle
+///  - `/sys/bus/usb/drivers/usb-storage/{unbind,bind}` driver rebind
+///  - Forced `echo "- - -" > /sys/class/scsi_host/hostN/scan`
+///
+/// Rolled back in 0.13.4. Callers (autorip, CLI) surface the error
+/// directly and prompt the user to physically reconnect the drive.
+/// If a future hardware class is found where USB-layer recovery
+/// actually works, the escalation belongs here, gated on the wedge
+/// signature — see git tag `v0.13.3` for the full implementation.
+pub(super) fn drive_has_disc(path: &Path) -> Result<bool> {
+    let mut transport = SgIoTransport::open(path)?;
+    let cdb = [crate::scsi::SCSI_TEST_UNIT_READY, 0, 0, 0, 0, 0];
+    let mut buf = [0u8; 0];
+    match transport.execute(
+        &cdb,
+        crate::scsi::DataDirection::None,
+        &mut buf,
+        crate::scsi::TUR_TIMEOUT_MS,
+    ) {
+        Ok(_) => Ok(true),
+        Err(Error::ScsiError {
+            sense_key: SENSE_KEY_NOT_READY,
+            ..
+        }) => Ok(false),
+        Err(e) => Err(e),
+    }
+}

src/scsi/macos.rs

@@ -63,7 +63,8 @@ struct SCSITaskSGElement {
 
 // ── External IOKit / CoreFoundation functions ───────────────────────────────
 
-extern "C" {
+// Rust 2024: FFI blocks declaring extern fns must be `unsafe extern`.
+unsafe extern "C" {
     fn IOMasterPort(bootstrap: u32, master: *mut MachPort) -> IOReturn;
     fn IOBSDNameMatching(
         master: MachPort,
@@ -97,10 +98,18 @@ extern "C" {
 // IOSCSIArchitectureModelFamily/UserClientLib/SCSITaskLib.h
 
 /// Read a function pointer from a COM vtable at the given index.
+///
+/// # Safety
+/// `iface` must be a valid COM interface pointer (*mut *mut c_void), and
+/// `index` must be a valid vtable slot for the target type `T`.
 unsafe fn vtable_fn<T>(iface: ComRef, index: usize) -> T {
-    let vtable = *iface as *const *const std::ffi::c_void;
-    let fn_ptr = *vtable.add(index);
-    std::mem::transmute_copy(&fn_ptr)
+    // Rust 2024: `unsafe fn` bodies are no longer implicitly unsafe.
+    // Each unsafe op needs its own `unsafe { }` block.
+    unsafe {
+        let vtable = *iface as *const *const std::ffi::c_void;
+        let fn_ptr = *vtable.add(index);
+        std::mem::transmute_copy(&fn_ptr)
+    }
 }
 
 /// Call Release (vtable index 3) on any COM interface.
@@ -166,6 +175,9 @@ const VTIDX_EXECUTE_SYNC: usize = 15;
 pub struct MacScsiTransport {
     device_iface: ComRef,
     exclusive: bool,
+    /// BSD name (e.g. "disk2") retained for `try_recover()` after a
+    /// task-level failure. Without it we can't re-call `find_scsi_service`.
+    bsd_name: String,
 }
 
 // IOKit COM interface pointers are Mach port references — safe to send between threads.
@@ -186,6 +198,19 @@ impl MacScsiTransport {
             dev_str
         };
 
+        let device_iface = Self::acquire_device_iface(bsd_name)?;
+
+        Ok(MacScsiTransport {
+            device_iface,
+            exclusive: true,
+            bsd_name: bsd_name.to_string(),
+        })
+    }
+
+    /// Resolve the BSD name → IOKit SCSITaskDeviceInterface with exclusive
+    /// access. Shared between `open()` and `try_recover()`. Returns the
+    /// COM ref the caller must release.
+    fn acquire_device_iface(bsd_name: &str) -> Result<ComRef> {
         let service = find_scsi_service(bsd_name)?;
 
         // Create IOKit plugin for the MMC device
@@ -203,8 +228,9 @@ impl MacScsiTransport {
         unsafe { IOObjectRelease(service) };
 
         if kr != K_IO_RETURN_SUCCESS || plugin.is_null() {
-            return Err(Error::DeviceNotFound {
-                path: format!("{}: IOKit plugin creation failed (0x{:08x})", dev_str, kr),
+            return Err(Error::IoKitPluginFailed {
+                path: bsd_name.to_string(),
+                kr: kr as u32,
             });
         }
 
@@ -222,8 +248,8 @@ impl MacScsiTransport {
         com_release(plugin);
 
         if hr != 0 || device_iface.is_null() {
-            return Err(Error::DeviceNotFound {
-                path: format!("{}: SCSITaskDeviceInterface not available", dev_str),
+            return Err(Error::ScsiInterfaceUnavailable {
+                path: bsd_name.to_string(),
             });
         }
 
@@ -235,41 +261,130 @@ impl MacScsiTransport {
         };
         if kr != K_IO_RETURN_SUCCESS {
             com_release(device_iface);
-            return Err(Error::DevicePermission {
-                path: format!(
-                    "{}: exclusive access denied (0x{:08x}). Try: diskutil unmountDisk {}",
-                    dev_str, kr, dev_str
-                ),
+            return Err(Error::DeviceLocked {
+                path: bsd_name.to_string(),
+                kr: kr as u32,
             });
         }
 
-        Ok(MacScsiTransport {
-            device_iface,
-            exclusive: true,
-        })
+        Ok(device_iface)
     }
 
-    /// Reset the drive to a known good state.
-    /// On macOS, we open the device, release exclusive access, wait for
-    /// the system to reclaim it, then the next open() re-acquires.
-    /// IOKit's USB layer handles device-level resets internally when the
-    /// exclusive access is released and re-acquired.
+    /// Recover the IOKit interface after a task-level failure. Releases
+    /// the current device_iface and re-acquires fresh state via
+    /// `acquire_device_iface`. Same observable contract as the Linux fd
+    /// recovery: after `try_recover()`, the next `execute()` either uses a
+    /// fresh interface or returns `DeviceNotFound` if recovery failed.
     ///
-    /// NOTE: untested — macOS reset may need IOUSBDeviceInterface::ResetDevice()
-    /// for USB drives. This is a best-effort implementation.
-    pub fn reset(device: &Path) -> Result<()> {
-        // Opening and immediately dropping triggers release of exclusive access
-        // which forces IOKit to reset the device state.
-        if let Ok(transport) = Self::open(device) {
-            drop(transport); // Drop releases exclusive access + closes plugin
+    /// Synchronous because IOKit `RELEASE_EXCLUSIVE` + `com_release` don't
+    /// block on in-flight CDBs the way Linux SG_IO `close` does.
+    fn try_recover(&mut self) {
+        if !self.device_iface.is_null() {
+            if self.exclusive {
+                unsafe {
+                    type Fn = unsafe extern "C" fn(ComRef) -> IOReturn;
+                    let f: Fn = vtable_fn(self.device_iface, VTIDX_RELEASE_EXCLUSIVE);
+                    f(self.device_iface);
+                }
+                self.exclusive = false;
+            }
+            com_release(self.device_iface);
+            self.device_iface = std::ptr::null_mut();
         }
-        std::thread::sleep(std::time::Duration::from_secs(2));
-        Ok(())
+        match Self::acquire_device_iface(&self.bsd_name) {
+            Ok(new_iface) => {
+                self.device_iface = new_iface;
+                self.exclusive = true;
+            }
+            Err(_) => {
+                // Leave device_iface null; next execute() returns
+                // DeviceNotFound. Caller's retry path will reopen Drive.
+                self.device_iface = std::ptr::null_mut();
+                self.exclusive = false;
+            }
+        }
+    }
+
+    // `reset()` removed in 0.13.6 — see scsi/mod.rs for rationale.
+}
+
+/// Enumerate optical drives on macOS. Mirrors `drive::macos::find_drives`
+/// (which iterates `/dev/disk0..15` + INQUIRY + filters peripheral
+/// type 5). Same logic, exposed through the new `DriveInfo` shape so
+/// callers — `list_drives()` in `scsi::mod` — never reach into
+/// `crate::drive::macos`.
+pub(super) fn list_drives() -> Vec<super::DriveInfo> {
+    let mut out = Vec::new();
+    for i in 0..K_DEV_DISK_MAX {
+        let path = format!("/dev/disk{i}");
+        if !std::path::Path::new(&path).exists() {
+            continue;
+        }
+        let mut transport = match MacScsiTransport::open(std::path::Path::new(&path)) {
+            Ok(t) => t,
+            Err(_) => continue,
+        };
+        let inquiry = match super::inquiry(&mut transport) {
+            Ok(r) => r,
+            Err(_) => continue,
+        };
+        // SCSI peripheral type field is the lower 5 bits of byte 0.
+        if inquiry.raw.is_empty()
+            || (inquiry.raw[K_INQUIRY_TYPE_BYTE] & K_INQUIRY_TYPE_MASK) != K_SCSI_TYPE_OPTICAL
+        {
+            continue;
+        }
+        out.push(super::DriveInfo {
+            path,
+            vendor: inquiry.vendor_id,
+            model: inquiry.model,
+            firmware: inquiry.firmware,
+        });
+    }
+    out
+}
+
+/// Maximum BSD disk index probed during enumeration. macOS assigns
+/// `/dev/diskN` sequentially per attached storage device; 16 covers
+/// any realistic homelab.
+const K_DEV_DISK_MAX: u8 = 16;
+
+/// SCSI INQUIRY response: peripheral device type lives in byte 0,
+/// lower 5 bits.
+const K_INQUIRY_TYPE_BYTE: usize = 0;
+const K_INQUIRY_TYPE_MASK: u8 = 0x1F;
+
+/// SCSI peripheral type 5 = "CD-ROM device" (covers DVD, BD-ROM, BD-RE).
+const K_SCSI_TYPE_OPTICAL: u8 = 0x05;
+
+/// TEST UNIT READY probe on macOS. Any non-"not ready" error bubbles up
+/// to the caller — in-library wedge recovery was rolled back in 0.13.4
+/// after USB-layer resets failed to recover the LG BU40N on Linux; the
+/// macOS impl mirrors that choice for symmetry. See the Linux
+/// `drive_has_disc` in `scsi/linux.rs` for the full rationale.
+pub(super) fn drive_has_disc(path: &Path) -> Result<bool> {
+    let mut transport = MacScsiTransport::open(path)?;
+    let cdb = [crate::scsi::SCSI_TEST_UNIT_READY, 0, 0, 0, 0, 0];
+    let mut buf = [0u8; 0];
+    match transport.execute(
+        &cdb,
+        crate::scsi::DataDirection::None,
+        &mut buf,
+        crate::scsi::TUR_TIMEOUT_MS,
+    ) {
+        Ok(_) => Ok(true),
+        Err(Error::ScsiError { sense_key, .. }) if sense_key == K_SENSE_KEY_NOT_READY => Ok(false),
+        Err(e) => Err(e),
     }
 }
 
+const K_SENSE_KEY_NOT_READY: u8 = 2;
+
 impl Drop for MacScsiTransport {
     fn drop(&mut self) {
+        if self.device_iface.is_null() {
+            return;
+        }
         if self.exclusive {
             unsafe {
                 type Fn = unsafe extern "C" fn(ComRef) -> IOReturn;
@@ -289,6 +404,15 @@ impl ScsiTransport for MacScsiTransport {
         data: &mut [u8],
         timeout_ms: u32,
     ) -> Result<ScsiResult> {
+        // Per RIP_DESIGN.md §15.1: parity with Linux/Windows recovery
+        // contract. If a prior execute() invalidated the interface and
+        // try_recover() also failed, fail fast.
+        if self.device_iface.is_null() {
+            return Err(Error::DeviceNotFound {
+                path: self.bsd_name.clone(),
+            });
+        }
+
         // Create a SCSI task
         let task: ComRef = unsafe {
             type Fn = unsafe extern "C" fn(ComRef) -> ComRef;
@@ -296,6 +420,7 @@ impl ScsiTransport for MacScsiTransport {
             f(self.device_iface)
         };
         if task.is_null() {
+            self.try_recover();
             return Err(Error::ScsiError {
                 opcode: cdb[0],
                 status: 0xFF,
@@ -366,6 +491,9 @@ impl ScsiTransport for MacScsiTransport {
         com_release(task);
 
         if kr != K_IO_RETURN_SUCCESS {
+            // Task-level failure (timeout / IOKit error). Recover the
+            // interface so the caller's retry path can resume.
+            self.try_recover();
             return Err(Error::ScsiError {
                 opcode: cdb[0],
                 status: 0xFF,
@@ -395,13 +523,23 @@ impl ScsiTransport for MacScsiTransport {
 /// BSD name → IOKit service for the SCSI device.
 ///
 /// Walk: IOMedia (BSD name match) → parent chain → SCSIPeripheralDeviceNub.
+///
+/// All failure paths surface as `Error::DeviceNotFound { path: bsd_name }` —
+/// the four internal stages (IOMasterPort / IOBSDNameMatching / IOMedia
+/// lookup / walk_to_authoring_device) collapse into one observable error
+/// because none of them are user-actionable individually. Pre-0.13 each
+/// stage stuffed an English description into `path:` ("…IOMasterPort
+/// failed", "…SCSITaskDeviceInterface not available", etc.) which broke
+/// the library's "no English text" rule.
 fn find_scsi_service(bsd_name: &str) -> Result<IOObject> {
+    let not_found = || Error::DeviceNotFound {
+        path: bsd_name.to_string(),
+    };
+
     let mut master: MachPort = 0;
     let kr = unsafe { IOMasterPort(0, &mut master) };
     if kr != K_IO_RETURN_SUCCESS {
-        return Err(Error::DeviceNotFound {
-            path: format!("{}: IOMasterPort failed", bsd_name),
-        });
+        return Err(not_found());
     }
 
     // IOBSDNameMatching creates a dictionary matching { "BSD Name" = bsd_name }
@@ -409,17 +547,13 @@ fn find_scsi_service(bsd_name: &str) -> Result<IOObject> {
     bsd_c.push(0);
     let matching = unsafe { IOBSDNameMatching(master, 0, bsd_c.as_ptr()) };
     if matching.is_null() {
-        return Err(Error::DeviceNotFound {
-            path: format!("{}: IOBSDNameMatching failed", bsd_name),
-        });
+        return Err(not_found());
     }
 
     // Find the single IOMedia service (consumes the matching dict)
     let media = unsafe { IOServiceGetMatchingService(master, matching) };
     if media == 0 {
-        return Err(Error::DeviceNotFound {
-            path: format!("{}: no IOMedia found", bsd_name),
-        });
+        return Err(not_found());
     }
 
     // Walk up the IOService plane to find the authoring device.
@@ -432,9 +566,7 @@ fn find_scsi_service(bsd_name: &str) -> Result<IOObject> {
     let service = walk_to_authoring_device(media);
     unsafe { IOObjectRelease(media) };
 
-    service.ok_or_else(|| Error::DeviceNotFound {
-        path: format!("{}: no SCSI authoring device in IORegistry", bsd_name),
-    })
+    service.ok_or_else(not_found)
 }
 
 /// Walk up the IOService plane from an IOMedia to the SCSI authoring device.
@@ -455,8 +587,9 @@ fn walk_to_authoring_device(start: IOObject) -> Option<IOObject> {
     // Walk up to 10 levels (more than enough)
     for _ in 0..10 {
         let mut parent: IOObject = 0;
-        let kr =
-            unsafe { IORegistryEntryGetParentEntry(current, b"IOService\0".as_ptr(), &mut parent) };
+        let kr = unsafe {
+            IORegistryEntryGetParentEntry(current, c"IOService".as_ptr() as *const u8, &mut parent)
+        };
 
         if current != start {
             unsafe { IOObjectRelease(current) };

src/scsi/mod.rs

@@ -18,6 +18,10 @@ use std::path::Path;
 
 // ── SCSI opcodes (SPC-4, MMC-6) ────────────────────────────────────────────
 
+/// SPC-4 TEST UNIT READY — six-byte CDB, no data transfer. Used by
+/// [`drive_has_disc`] as the cheapest "is the drive responsive / does
+/// it have media?" probe.
+pub const SCSI_TEST_UNIT_READY: u8 = 0x00;
 pub const SCSI_INQUIRY: u8 = 0x12;
 pub const SCSI_READ_CAPACITY: u8 = 0x25;
 pub const SCSI_READ_10: u8 = 0x28;
@@ -33,6 +37,12 @@ pub const SCSI_READ_DISC_STRUCTURE: u8 = 0xAD;
 /// AACS key class for REPORT KEY / SEND KEY commands.
 pub const AACS_KEY_CLASS: u8 = 0x02;
 
+/// Timeout for TEST UNIT READY probes used by [`drive_has_disc`].
+/// TUR is the cheapest SCSI op (no data transfer); 5 s is generous
+/// for any healthy bus and short enough that a hung device can't stall
+/// a poll-loop tick.
+pub(crate) const TUR_TIMEOUT_MS: u32 = 5_000;
+
 // ── Types ───────────────────────────────────────────────────────────────────
 
 #[derive(Debug, Clone, Copy, PartialEq)]
@@ -82,34 +92,144 @@ pub fn open(device: &Path) -> Result<Box<dyn ScsiTransport>> {
 
     #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
     {
-        Err(Error::DeviceNotFound {
-            path: format!("{}: unsupported platform", device.display()),
+        Err(Error::UnsupportedPlatform {
+            target: std::env::consts::OS.to_string(),
         })
     }
 }
 
-/// Reset a SCSI device to a known good state. Platform-specific.
-/// On Linux: open/close fd cycle + TUR + SG_SCSI_RESET escalation.
-pub fn reset(device: &Path) -> Result<()> {
+// Note: a top-level `scsi::reset()` used to live here, wrapping a
+// platform reset in a thread+recv_timeout so a kernel-wedged ioctl
+// couldn't hang the caller. Removed in 0.13.6 along with the
+// SG_SCSI_RESET / STOP+START UNIT escalation that needed it. The
+// remaining platform reset (Linux: SgIoTransport::reset, called only
+// from SgIoTransport::open) does pure userspace state cleanup with
+// bounded sleeps — no escape-hatch wrapper required.
+
+// ── USB-layer recovery: rolled back in 0.13.4 ───────────────────────────────
+//
+// 0.13.1 – 0.13.3 exposed `scsi::usb_reset()` (`USBDEVFS_RESET` on Linux,
+// `IOUSBDeviceInterface::ResetDevice` on macOS) and chained it into
+// `drive_has_disc` recovery. Production testing on the LG BU40N USB BD-RE
+// confirmed the USB stack resets succeed — dmesg logs
+// `usb 3-2: reset high-speed USB device` and the device re-authorises —
+// but the drive firmware below the USB bridge stays locked: LUN never
+// re-enumerates, TUR still times out, the drive is unusable until
+// physical unplug-replug or host reboot. Additional approaches tried
+// and discarded: `authorized` 0→1 toggle, usb-storage driver
+// unbind/rebind, forced SCSI host rescan, `STOP` + `START UNIT`.
+//
+// The APIs were removed so no caller can be misled into thinking a
+// software-only recovery exists for this class of wedge. If a future
+// hardware class surfaces where USB-layer recovery actually helps, the
+// code should live here again, gated on a wedge signature — see git
+// tag `v0.13.3` for the full implementation.
+
+// ── Lightweight discovery + presence probes ─────────────────────────────────
+//
+// These two are the *only* hardware-touching APIs autorip + freemkv CLI use
+// outside the rip path itself. They're intentionally cheap:
+//
+// - `list_drives()` is a one-shot enumeration: filesystem walk for sg/cdrom
+//   nodes, type-5 filter, single INQUIRY per candidate. No firmware, no
+//   reset-on-open, no init. Caller caches the result.
+// - `drive_has_disc(path)` is a single TEST UNIT READY (six-byte CDB, no
+//   data transfer) with internal wedge-recovery escalation. Callers in a
+//   poll loop don't need any other primitive to detect "disc inserted /
+//   removed" — and they never see the SCSI-vs-USB-reset escalation.
+//
+// `Drive::open` + `drive.init()` + `Disc::scan` remain heavy and on-demand;
+// callers only invoke them once they've decided to actually rip / verify a
+// specific drive.
+
+/// One optical drive on the system. Returned by [`list_drives`]. The
+/// fields are populated from a single INQUIRY at enumeration time —
+/// no firmware reset, no init.
+#[derive(Debug, Clone)]
+pub struct DriveInfo {
+    /// Platform device path: `/dev/sgN` (Linux), `/dev/diskN` (macOS),
+    /// `\\.\CdRomN` (Windows).
+    pub path: String,
+    /// SCSI INQUIRY vendor identifier (e.g. `"HL-DT-ST"`).
+    pub vendor: String,
+    /// SCSI INQUIRY product identifier (e.g. `"BD-RE BU40N"`).
+    pub model: String,
+    /// SCSI INQUIRY firmware revision (e.g. `"1.04"`).
+    pub firmware: String,
+}
+
+/// Enumerate optical drives present on the system.
+///
+/// **What it does**: per-platform sysfs / IOKit / setupapi walk for SCSI
+/// devices, filtered to type 5 (CD/DVD/BD), with a single INQUIRY each
+/// for vendor/model/firmware. No firmware reset, no `Drive::init`, no
+/// disc scan. Suitable for an autorip-style poll loop or a CLI's
+/// drive-list command.
+///
+/// **What it doesn't do**: probe disc presence (use [`drive_has_disc`]),
+/// open a `Drive` for ripping (use [`crate::Drive::open`]), or load
+/// drive profiles. Those are heavier operations callers invoke once
+/// they've selected a drive.
+pub fn list_drives() -> Vec<DriveInfo> {
     #[cfg(target_os = "linux")]
     {
-        linux::SgIoTransport::reset(device)
+        linux::list_drives()
     }
 
     #[cfg(target_os = "macos")]
     {
-        macos::MacScsiTransport::reset(device)
+        macos::list_drives()
     }
 
     #[cfg(target_os = "windows")]
     {
-        windows::SptiTransport::reset(device)
+        windows::list_drives()
     }
 
     #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
     {
-        let _ = device;
-        Ok(())
+        Vec::new()
+    }
+}
+
+/// True if the drive at `path` currently has a disc inserted.
+///
+/// Issues a single TEST UNIT READY (cheapest SCSI op, no data transfer).
+/// Sense-key 2 ("not ready, medium not present") → `Ok(false)`; any
+/// other ready/not-ready response → `Ok(true)` or interpreted ready
+/// state. Suitable for poll-loop tick (~50 ms / drive on a healthy bus).
+///
+/// **Internal wedge recovery.** When the kernel's response indicates a
+/// wedged target — the `0xff` status pattern that means "no answer from
+/// the device" — this function transparently escalates: SCSI bus reset
+/// → if still wedged → USB device reset (`USBDEVFS_RESET` on Linux) →
+/// retry TUR. Callers never see wedge errors and never need to know
+/// about the escalation; if even the recovery path can't get a response,
+/// `Err(DeviceResetFailed)` surfaces. **No SCSI primitive is exposed to
+/// outside crates** — autorip / freemkv CLI / bdemu use this single
+/// function for the entire "is there a disc?" decision.
+pub fn drive_has_disc(path: &Path) -> Result<bool> {
+    #[cfg(target_os = "linux")]
+    {
+        linux::drive_has_disc(path)
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        macos::drive_has_disc(path)
+    }
+
+    #[cfg(target_os = "windows")]
+    {
+        windows::drive_has_disc(path)
+    }
+
+    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
+    {
+        let _ = path;
+        Err(Error::UnsupportedPlatform {
+            target: std::env::consts::OS.to_string(),
+        })
     }
 }
 

src/scsi/windows.rs

@@ -56,7 +56,7 @@ struct SptwbDirect {
 
 // ── Windows FFI ────────────────────────────────────────────────────────────
 
-extern "system" {
+unsafe extern "system" {
     fn CreateFileW(
         lpFileName: *const u16,
         dwDesiredAccess: u32,
@@ -85,8 +85,16 @@ extern "system" {
 
 pub struct SptiTransport {
     handle: isize,
+    /// Wide-encoded device path used by `try_recover()` to reopen the
+    /// handle after a failed DeviceIoControl. Saved from `open()` so we
+    /// don't have to re-resolve the device path on recovery.
+    wide_path: Vec<u16>,
 }
 
+// SptiTransport contains an isize HANDLE and a Vec<u16>; both Send. The
+// auto-derived Send is intentional. Sync is NOT — handle mutation in
+// execute() requires &mut, enforced by the trait object dispatch.
+
 /// Normalize a device path to Windows \\.\X: format.
 ///
 /// NOTE: A near-identical `normalize_path` exists in `drive::windows`.
@@ -129,12 +137,48 @@ impl SptiTransport {
         };
 
         if handle == INVALID_HANDLE_VALUE {
-            return Err(Error::DeviceNotFound {
-                path: format!("{}: cannot open device (run as administrator)", dev_str),
+            // Map last-os-error → Error variant; don't embed English hints
+            // in the path field (the CLI handles localization).
+            let err = std::io::Error::last_os_error();
+            return Err(if err.kind() == std::io::ErrorKind::PermissionDenied {
+                Error::DevicePermission {
+                    path: dev_str.to_string(),
+                }
+            } else {
+                Error::DeviceNotFound {
+                    path: dev_str.to_string(),
+                }
             });
         }
 
-        Ok(SptiTransport { handle })
+        Ok(SptiTransport {
+            handle,
+            wide_path: wide,
+        })
+    }
+
+    /// Recover the handle after a failed DeviceIoControl. Closes the bad
+    /// handle and opens a fresh one synchronously (CloseHandle/CreateFileW
+    /// are fast on Windows — no in-flight CDB to drain like Linux SG_IO).
+    /// On success, `self.handle` is replaced and the next `execute()` call
+    /// uses the new handle. On failure, `self.handle` is set to
+    /// INVALID_HANDLE_VALUE and subsequent calls return `DeviceNotFound`.
+    fn try_recover(&mut self) {
+        if self.handle != INVALID_HANDLE_VALUE {
+            unsafe { CloseHandle(self.handle) };
+        }
+        let new_handle = unsafe {
+            CreateFileW(
+                self.wide_path.as_ptr(),
+                GENERIC_READ | GENERIC_WRITE,
+                FILE_SHARE_READ | FILE_SHARE_WRITE,
+                std::ptr::null(),
+                OPEN_EXISTING,
+                FILE_ATTRIBUTE_NORMAL,
+                std::ptr::null(),
+            )
+        };
+        self.handle = new_handle;
     }
 
     /// Reset the drive to a known good state.
@@ -187,10 +231,45 @@ impl SptiTransport {
     }
 }
 
+/// Enumerate optical drives on Windows via `find_drives()` (CdRom0..15
+/// scan) and re-shape into `DriveInfo`. Existing implementation already
+/// returns `(path, DriveId)`; mapped here to the public struct.
+pub(super) fn list_drives() -> Vec<super::DriveInfo> {
+    crate::drive::windows::find_drives()
+        .into_iter()
+        .map(|(path, id)| super::DriveInfo {
+            path,
+            vendor: id.vendor_id.trim().to_string(),
+            model: id.product_id.trim().to_string(),
+            firmware: id.product_revision.trim().to_string(),
+        })
+        .collect()
+}
+
+/// TEST UNIT READY probe on Windows. No in-library recovery — see the
+/// Linux `drive_has_disc` doc block for the rationale.
+pub(super) fn drive_has_disc(path: &Path) -> Result<bool> {
+    let mut transport = SptiTransport::open(path)?;
+    let cdb = [crate::scsi::SCSI_TEST_UNIT_READY, 0, 0, 0, 0, 0];
+    let mut buf = [0u8; 0];
+    match transport.execute(
+        &cdb,
+        crate::scsi::DataDirection::None,
+        &mut buf,
+        crate::scsi::TUR_TIMEOUT_MS,
+    ) {
+        Ok(_) => Ok(true),
+        Err(Error::ScsiError { sense_key: 2, .. }) => Ok(false),
+        Err(e) => Err(e),
+    }
+}
+
 impl Drop for SptiTransport {
     fn drop(&mut self) {
-        unsafe {
-            CloseHandle(self.handle);
+        if self.handle != INVALID_HANDLE_VALUE {
+            unsafe {
+                CloseHandle(self.handle);
+            }
         }
     }
 }
@@ -203,6 +282,15 @@ impl ScsiTransport for SptiTransport {
         data: &mut [u8],
         timeout_ms: u32,
     ) -> Result<ScsiResult> {
+        // Per RIP_DESIGN.md §15.1: parity with Linux's recovery contract.
+        // If a prior call invalidated the handle and try_recover() also
+        // failed, fail fast.
+        if self.handle == INVALID_HANDLE_VALUE {
+            return Err(Error::DeviceNotFound {
+                path: String::new(),
+            });
+        }
+
         // Zero the data buffer for reads to prevent returning uninitialized data
         // if the driver doesn't fully update DataTransferLength.
         if direction == DataDirection::FromDevice {
@@ -221,7 +309,11 @@ impl ScsiTransport for SptiTransport {
             DataDirection::ToDevice => SCSI_IOCTL_DATA_OUT,
         };
         sptwb.spt.DataTransferLength = data.len() as u32;
-        sptwb.spt.TimeOutValue = (timeout_ms / 1000).max(1) as u32;
+        // Round up to the next whole second so a 1500ms request gets at
+        // least 2s, not 1s. SPTI's TimeOutValue is u32 seconds with no
+        // sub-second resolution; biasing toward "more time" is safer than
+        // truncating (truncation broke 1500ms fast-reads on Drive::read).
+        sptwb.spt.TimeOutValue = ((timeout_ms + 999) / 1000).max(1);
         sptwb.spt.DataBuffer = if data.is_empty() {
             std::ptr::null_mut()
         } else {
@@ -247,6 +339,12 @@ impl ScsiTransport for SptiTransport {
         };
 
         if ok == 0 {
+            // Driver-level failure (timeout, handle gone, etc.). Recover
+            // the handle so the caller's retry loop can resume — same
+            // observable contract as Linux's async fd recovery, but
+            // synchronous because Windows's CloseHandle/CreateFileW don't
+            // block on in-flight CDBs.
+            self.try_recover();
             return Err(Error::ScsiError {
                 opcode: cdb[0],
                 status: 0xFF,

src/sector.rs

@@ -10,7 +10,15 @@ use crate::error::Result;
 pub trait SectorReader: Send {
     /// Read `count` sectors starting at `lba` into `buf`.
     /// `buf` must be at least `count * 2048` bytes.
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize>;
+    /// `recovery`: true = full retry/reset loop (ripping), false = single attempt (verify).
+    /// File-backed readers ignore the flag.
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        recovery: bool,
+    ) -> Result<usize>;
 
     /// Total capacity in sectors, if known.
     fn capacity(&self) -> u32 {
@@ -31,10 +39,12 @@ impl FileSectorReader {
         let len = file.metadata()?.len();
         let sectors = len / 2048;
         if sectors > u32::MAX as u64 {
-            return Err(std::io::Error::new(
-                std::io::ErrorKind::InvalidData,
-                format!("{path}: image too large, max ~8 TB"),
-            ));
+            // ~8 TB hard cap (u32::MAX × 2048 bytes). Path lives in the
+            // typed Error variant — no English in the message.
+            return Err(crate::error::Error::IsoTooLarge {
+                path: path.to_string(),
+            }
+            .into());
         }
         let capacity = sectors as u32;
         Ok(Self {
@@ -45,7 +55,13 @@ impl FileSectorReader {
 }
 
 impl SectorReader for FileSectorReader {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
         use std::io::{Read, Seek, SeekFrom};
         let offset = lba as u64 * 2048;
         let bytes = count as usize * 2048;

src/udf.rs

@@ -61,6 +61,11 @@ impl UdfFs {
         self.metadata_start
     }
 
+    /// Metadata partition size in sectors.
+    pub(crate) fn metadata_sectors(&self) -> u32 {
+        self.metadata_sectors
+    }
+
     /// Find a directory by path (e.g. "/BDMV/PLAYLIST").
     /// Path matching is case-insensitive.
     pub fn find_dir(&self, path: &str) -> Option<&DirEntry> {
@@ -96,7 +101,7 @@ impl UdfFs {
             None => {
                 return Err(Error::UdfNotFound {
                     path: path.to_string(),
-                })
+                });
             }
         };
         let entry = current
@@ -131,7 +136,7 @@ impl UdfFs {
             None => {
                 return Err(Error::UdfNotFound {
                     path: path.to_string(),
-                })
+                });
             }
         };
         let entry = current
@@ -370,7 +375,7 @@ impl UdfFs {
             None => {
                 return Err(Error::UdfNotFound {
                     path: path.to_string(),
-                })
+                });
             }
         };
         let entry = current
@@ -832,7 +837,133 @@ fn parse_dstring(data: &[u8]) -> String {
 
 /// Read a single 2048-byte sector from the drive.
 /// Uses standard READ(10) — no unlock required.
+/// Buffered sector reader — reduces SCSI round-trips by pre-fetching blocks.
+/// Each SCSI command has ~500ms overhead on USB drives, so reading 32 sectors
+/// at once (one command) is 32x faster than 32 individual reads.
+pub(crate) struct BufferedSectorReader<'a> {
+    inner: &'a mut dyn SectorReader,
+    cache_start: u32,
+    cache: Vec<u8>,
+    cache_sectors: u32,
+    batch: u16,
+    /// Pre-fetched sector data from bulk reads (sector ranges for AACS, MPLS, CLPI, etc.)
+    prefetched: std::collections::HashMap<u32, Vec<u8>>,
+}
+
+impl<'a> BufferedSectorReader<'a> {
+    pub(crate) fn new(inner: &'a mut dyn SectorReader, batch: u16) -> Self {
+        Self {
+            inner,
+            cache_start: u32::MAX,
+            cache: Vec::new(),
+            cache_sectors: 0,
+            batch,
+            prefetched: std::collections::HashMap::new(),
+        }
+    }
+}
+
+impl BufferedSectorReader<'_> {
+    /// Pre-read a contiguous range of sectors into the sliding cache.
+    /// Used to bulk-load the UDF metadata partition so subsequent reads are instant.
+    pub(crate) fn prefetch(&mut self, start_lba: u32, count: u32) {
+        let total = count as usize * 2048;
+        self.cache.resize(total, 0);
+        let mut offset = 0u32;
+        while offset < count {
+            let batch = (count - offset).min(self.batch as u32) as u16;
+            let buf_off = offset as usize * 2048;
+            if self
+                .inner
+                .read_sectors(
+                    start_lba + offset,
+                    batch,
+                    &mut self.cache[buf_off..buf_off + batch as usize * 2048],
+                    true,
+                )
+                .is_err()
+            {
+                break;
+            }
+            offset += batch as u32;
+        }
+        self.cache_start = start_lba;
+        self.cache_sectors = offset;
+    }
+
+    /// Pre-read multiple sector ranges into the permanent cache.
+    /// Each range is read in batch-sized chunks and stored per-sector in a HashMap.
+    /// Used to bulk-load all small files (AACS, MPLS, CLPI, META) before scanning.
+    pub(crate) fn prefetch_ranges(&mut self, ranges: &[(u32, u32)]) {
+        let mut tmp = vec![0u8; self.batch as usize * 2048];
+        for &(start, count) in ranges {
+            let mut offset = 0u32;
+            while offset < count {
+                let batch = (count - offset).min(self.batch as u32) as u16;
+                let bytes = batch as usize * 2048;
+                if self
+                    .inner
+                    .read_sectors(start + offset, batch, &mut tmp[..bytes], true)
+                    .is_err()
+                {
+                    break;
+                }
+                for i in 0..batch as u32 {
+                    let s = i as usize * 2048;
+                    self.prefetched
+                        .insert(start + offset + i, tmp[s..s + 2048].to_vec());
+                }
+                offset += batch as u32;
+            }
+        }
+    }
+}
+
+impl SectorReader for BufferedSectorReader<'_> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> std::result::Result<usize, crate::error::Error> {
+        if count == 1 {
+            // Check permanent prefetch cache first (HashMap)
+            if let Some(data) = self.prefetched.get(&lba) {
+                buf[..2048].copy_from_slice(data);
+                return Ok(2048);
+            }
+            // Check sliding cache
+            if lba >= self.cache_start && lba < self.cache_start + self.cache_sectors {
+                let offset = (lba - self.cache_start) as usize * 2048;
+                buf[..2048].copy_from_slice(&self.cache[offset..offset + 2048]);
+                return Ok(2048);
+            }
+            let block = self.batch;
+            self.cache.resize(block as usize * 2048, 0);
+            match self.inner.read_sectors(lba, block, &mut self.cache, true) {
+                Ok(_) => {
+                    self.cache_start = lba;
+                    self.cache_sectors = block as u32;
+                }
+                Err(_) => {
+                    // Near end of disc or error — single sector fallback
+                    self.cache.resize(2048, 0);
+                    self.inner.read_sectors(lba, 1, &mut self.cache, true)?;
+                    self.cache_start = lba;
+                    self.cache_sectors = 1;
+                }
+            }
+            buf[..2048].copy_from_slice(&self.cache[..2048]);
+            Ok(2048)
+        } else {
+            // Multi-sector read — pass through
+            self.inner.read_sectors(lba, count, buf, true)
+        }
+    }
+}
+
 fn read_sector(reader: &mut dyn SectorReader, lba: u32, buf: &mut [u8]) -> Result<()> {
-    reader.read_sectors(lba, 1, buf)?;
+    reader.read_sectors(lba, 1, buf, true)?;
     Ok(())
 }

src/verify.rs

@@ -0,0 +1,240 @@
+//! Disc sector verification — read every sector and classify health.
+
+use crate::disc::{Chapter, DiscTitle};
+use crate::sector::SectorReader;
+use std::time::Instant;
+
+/// Health status of a single sector read.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum SectorStatus {
+    /// Read succeeded on first attempt, under 500ms
+    Good,
+    /// Read succeeded but took longer than expected (>500ms per sector)
+    Slow,
+    /// Read failed initially but succeeded on retry
+    Recovered,
+    /// Read failed all attempts — unrecoverable
+    Bad,
+}
+
+/// A contiguous range of bad or slow sectors.
+#[derive(Debug, Clone)]
+pub struct SectorRange {
+    pub start_lba: u32,
+    pub count: u32,
+    pub status: SectorStatus,
+    /// Byte offset from start of title
+    pub byte_offset: u64,
+}
+
+/// Result of a disc verification scan.
+#[derive(Debug, Clone)]
+pub struct VerifyResult {
+    pub total_sectors: u64,
+    pub good: u64,
+    pub slow: u64,
+    pub recovered: u64,
+    pub bad: u64,
+    /// Contiguous ranges of non-good sectors
+    pub ranges: Vec<SectorRange>,
+    pub elapsed_secs: f64,
+}
+
+impl VerifyResult {
+    /// Percentage of sectors that are fully readable (good + slow + recovered).
+    pub fn readable_pct(&self) -> f64 {
+        if self.total_sectors == 0 {
+            return 100.0;
+        }
+        (self.total_sectors - self.bad) as f64 / self.total_sectors as f64 * 100.0
+    }
+
+    /// True if every sector read successfully.
+    pub fn is_perfect(&self) -> bool {
+        self.bad == 0 && self.recovered == 0 && self.slow == 0
+    }
+
+    /// Map a bad sector range to a chapter timestamp.
+    pub fn chapter_at_offset(
+        chapters: &[Chapter],
+        byte_offset: u64,
+        duration_secs: f64,
+        total_bytes: u64,
+    ) -> Option<(usize, f64)> {
+        if total_bytes == 0 || chapters.is_empty() {
+            return None;
+        }
+        let time_secs = byte_offset as f64 / total_bytes as f64 * duration_secs;
+        let mut chapter_idx = 0;
+        for (i, ch) in chapters.iter().enumerate() {
+            if ch.time_secs <= time_secs {
+                chapter_idx = i;
+            } else {
+                break;
+            }
+        }
+        Some((chapter_idx + 1, time_secs))
+    }
+}
+
+/// Progress callback: (sectors_done, total_sectors, current_status)
+/// Return false to stop verification early.
+pub type ProgressFn = Box<dyn FnMut(u64, u64, SectorStatus) -> bool>;
+
+/// Verify all sectors in a title's extents.
+/// Reads in batches for speed, falls back to single-sector on failure.
+/// The progress callback returns false to request early stop.
+pub fn verify_title(
+    reader: &mut dyn SectorReader,
+    title: &DiscTitle,
+    batch_sectors: u16,
+    mut on_progress: Option<ProgressFn>,
+) -> VerifyResult {
+    let start = Instant::now();
+    let mut good: u64 = 0;
+    let mut slow: u64 = 0;
+    let mut recovered: u64 = 0;
+    let mut bad: u64 = 0;
+    let mut ranges: Vec<SectorRange> = Vec::new();
+    let mut sectors_done: u64 = 0;
+    let mut _stopped = false;
+    let mut byte_offset: u64 = 0;
+
+    let total_sectors: u64 = title.extents.iter().map(|e| e.sector_count as u64).sum();
+    let mut buf = vec![0u8; batch_sectors as usize * 2048];
+
+    'outer: for ext in &title.extents {
+        let mut offset: u32 = 0;
+        while offset < ext.sector_count {
+            let remaining = ext.sector_count - offset;
+            let count = remaining.min(batch_sectors as u32) as u16;
+            let lba = ext.start_lba + offset;
+            let bytes = count as usize * 2048;
+
+            let batch_start = Instant::now();
+            let batch_ok = reader
+                .read_sectors(lba, count, &mut buf[..bytes], false)
+                .is_ok();
+            let batch_ms = batch_start.elapsed().as_millis();
+
+            if batch_ok {
+                // Batch succeeded — classify by speed
+                let status = if batch_ms > count as u128 * 500 {
+                    SectorStatus::Slow
+                } else {
+                    SectorStatus::Good
+                };
+
+                match status {
+                    SectorStatus::Good => good += count as u64,
+                    SectorStatus::Slow => {
+                        slow += count as u64;
+                        ranges.push(SectorRange {
+                            start_lba: lba,
+                            count: count as u32,
+                            status: SectorStatus::Slow,
+                            byte_offset,
+                        });
+                    }
+                    _ => {}
+                }
+
+                sectors_done += count as u64;
+                if let Some(ref mut cb) = on_progress {
+                    if !cb(sectors_done, total_sectors, status) {
+                        _stopped = true;
+                        break 'outer;
+                    }
+                }
+            } else {
+                // Batch failed — test each sector individually
+                for i in 0..count {
+                    let sector_lba = lba + i as u32;
+                    let sector_offset = i as usize * 2048;
+                    let sector_byte_offset = byte_offset + i as u64 * 2048;
+
+                    let s1 = Instant::now();
+                    let first_ok = reader
+                        .read_sectors(
+                            sector_lba,
+                            1,
+                            &mut buf[sector_offset..sector_offset + 2048],
+                            false,
+                        )
+                        .is_ok();
+                    let s1_ms = s1.elapsed().as_millis();
+
+                    let status = if first_ok && s1_ms <= 500 {
+                        good += 1;
+                        SectorStatus::Good
+                    } else if first_ok {
+                        slow += 1;
+                        SectorStatus::Slow
+                    } else {
+                        // Retry once more after brief pause
+                        std::thread::sleep(std::time::Duration::from_secs(2));
+                        if reader
+                            .read_sectors(
+                                sector_lba,
+                                1,
+                                &mut buf[sector_offset..sector_offset + 2048],
+                                false,
+                            )
+                            .is_ok()
+                        {
+                            recovered += 1;
+                            SectorStatus::Recovered
+                        } else {
+                            bad += 1;
+                            SectorStatus::Bad
+                        }
+                    };
+
+                    if status != SectorStatus::Good {
+                        // Merge with previous range if contiguous and same status
+                        if let Some(last) = ranges.last_mut() {
+                            if last.status == status && last.start_lba + last.count == sector_lba {
+                                last.count += 1;
+                            } else {
+                                ranges.push(SectorRange {
+                                    start_lba: sector_lba,
+                                    count: 1,
+                                    status,
+                                    byte_offset: sector_byte_offset,
+                                });
+                            }
+                        } else {
+                            ranges.push(SectorRange {
+                                start_lba: sector_lba,
+                                count: 1,
+                                status,
+                                byte_offset: sector_byte_offset,
+                            });
+                        }
+                    }
+
+                    sectors_done += 1;
+                    if let Some(ref mut cb) = on_progress {
+                        if !cb(sectors_done, total_sectors, status) {
+                            _stopped = true;
+                            break 'outer;
+                        }
+                    }
+                }
+            }
+
+            offset += count as u32;
+            byte_offset += bytes as u64;
+        }
+    }
+
+    VerifyResult {
+        total_sectors,
+        good,
+        slow,
+        recovered,
+        bad,
+        ranges,
+        elapsed_secs: start.elapsed().as_secs_f64(),
+    }
+}

tests/crypto_tests.rs

@@ -27,7 +27,9 @@ fn css_descramble_sector_roundtrip_via_public_api() {
     assert_eq!(sector[0x14] & 0x30, 0x00, "flag not cleared");
     // Header preserved (except flag byte)
     for i in 0..128 {
-        if i == 0x14 { continue; }
+        if i == 0x14 {
+            continue;
+        }
         assert_eq!(sector[i], original[i], "header byte {} changed", i);
     }
     // Encrypted region modified
@@ -71,8 +73,8 @@ fn css_is_scrambled_detection() {
 /// then decrypt with decrypt_unit() and verify the plaintext matches.
 #[test]
 fn aacs_decrypt_unit_roundtrip() {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
     use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
 
     let unit_key = [0xAAu8; 16];
     let aacs_iv: [u8; 16] = [
@@ -205,8 +207,8 @@ fn aacs_disc_hash_deterministic() {
 /// decrypt_unit_key recovers the original.
 #[test]
 fn aacs_decrypt_unit_key_roundtrip() {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
     use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
 
     let vuk = [
         0x11u8, 0x14, 0x36, 0x0B, 0x10, 0xEE, 0x6E, 0xAC, 0x78, 0xAA, 0x4A, 0xC0, 0xB7, 0x52, 0xEA,
@@ -307,8 +309,8 @@ fn aacs_decrypt_unit_unencrypted_passthrough() {
 
 /// Independent AES-128-ECB encrypt (uses `aes` crate directly, NOT our library).
 fn ref_aes_ecb_encrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
     use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
     let cipher = Aes128::new(GenericArray::from_slice(key));
     let mut block = GenericArray::clone_from_slice(data);
     cipher.encrypt_block(&mut block);
@@ -319,8 +321,8 @@ fn ref_aes_ecb_encrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
 
 /// Independent AES-128-CBC encrypt (uses `aes` crate directly, NOT our library).
 fn ref_aes_cbc_encrypt(key: &[u8; 16], iv: &[u8; 16], data: &mut [u8]) {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
     use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
     let cipher = Aes128::new(GenericArray::from_slice(key));
     let mut prev = *iv;
     let num_blocks = data.len() / 16;
@@ -359,7 +361,9 @@ fn aacs_cross_validation_encrypt_then_decrypt() {
         plaintext[off] = 0x47;
         off += 192;
     }
-    // Fill the rest with a recognisable pattern (prime modulus avoids artefacts)
+    // Fill the rest with a recognisable pattern (prime modulus avoids artefacts).
+    // Index-arithmetic — clearer with a counted loop than an enumerate chain.
+    #[allow(clippy::needless_range_loop)]
     for i in 16..aacs::ALIGNED_UNIT_LEN {
         if plaintext[i] == 0 {
             plaintext[i] = (i % 251) as u8;
@@ -460,6 +464,7 @@ fn aacs_bus_decrypt_cross_validation() {
     ];
 
     let mut plaintext = vec![0u8; aacs::ALIGNED_UNIT_LEN];
+    #[allow(clippy::needless_range_loop)]
     for i in 0..aacs::ALIGNED_UNIT_LEN {
         plaintext[i] = ((i * 3 + 17) & 0xFF) as u8;
     }
@@ -492,6 +497,7 @@ fn css_roundtrip_with_snapshot() {
     let mut sector = vec![0x00u8; 2048];
     sector[0x14] = 0x30;
     sector[0x54..0x59].copy_from_slice(&[0xDE, 0xAD, 0xBE, 0xEF, 0x42]);
+    #[allow(clippy::needless_range_loop)]
     for i in 0x80..2048 {
         sector[i] = ((i * 7 + 3) & 0xFF) as u8;
     }
@@ -504,17 +510,33 @@ fn css_roundtrip_with_snapshot() {
     // Determinism: same input → same output
     let mut sector2 = original.clone();
     css::lfsr::descramble_sector(&title_key, &mut sector2);
-    assert_eq!(&sector[0x80..2048], &sector2[0x80..2048], "not deterministic");
+    assert_eq!(
+        &sector[0x80..2048],
+        &sector2[0x80..2048],
+        "not deterministic"
+    );
 }
 
 /// Multiple key/seed combinations produce different outputs.
 #[test]
 fn css_roundtrip_multiple_keys() {
     let cases: &[([u8; 5], [u8; 5])] = &[
-        ([0x00, 0x00, 0x00, 0x00, 0x00], [0x00, 0x00, 0x00, 0x00, 0x00]),
-        ([0xFF, 0xFF, 0xFF, 0xFF, 0xFF], [0xFF, 0xFF, 0xFF, 0xFF, 0xFF]),
-        ([0x01, 0x02, 0x03, 0x04, 0x05], [0xAA, 0xBB, 0xCC, 0xDD, 0xEE]),
-        ([0xAB, 0xCD, 0xEF, 0x01, 0x23], [0x12, 0x34, 0x56, 0x78, 0x9A]),
+        (
+            [0x00, 0x00, 0x00, 0x00, 0x00],
+            [0x00, 0x00, 0x00, 0x00, 0x00],
+        ),
+        (
+            [0xFF, 0xFF, 0xFF, 0xFF, 0xFF],
+            [0xFF, 0xFF, 0xFF, 0xFF, 0xFF],
+        ),
+        (
+            [0x01, 0x02, 0x03, 0x04, 0x05],
+            [0xAA, 0xBB, 0xCC, 0xDD, 0xEE],
+        ),
+        (
+            [0xAB, 0xCD, 0xEF, 0x01, 0x23],
+            [0x12, 0x34, 0x56, 0x78, 0x9A],
+        ),
     ];
 
     let mut results = Vec::new();
@@ -529,8 +551,12 @@ fn css_roundtrip_multiple_keys() {
     }
     // Different keys/seeds should produce different outputs
     for i in 0..results.len() {
-        for j in (i+1)..results.len() {
-            assert_ne!(results[i], results[j], "cases {} and {} produced same output", i, j);
+        for j in (i + 1)..results.len() {
+            assert_ne!(
+                results[i], results[j],
+                "cases {} and {} produced same output",
+                i, j
+            );
         }
     }
 }
@@ -639,6 +665,7 @@ fn css_recover_title_key_with_exact_plaintext() {
     sector[0x54..0x59].copy_from_slice(&seed);
     let pes_header: [u8; 10] = [0x00, 0x00, 0x01, 0xE0, 0x00, 0x00, 0x80, 0x80, 0x05, 0x21];
     sector[0x80..0x8A].copy_from_slice(&pes_header);
+    #[allow(clippy::needless_range_loop)]
     for i in 0x8A..2048 {
         sector[i] = ((i * 13 + 7) & 0xFF) as u8;
     }
@@ -681,7 +708,7 @@ fn aacs_parse_unit_key_ro_minimal() {
     data[0..4].copy_from_slice(&uk_pos.to_be_bytes());
     // app_type
     data[16] = 1; // BD-ROM
-                  // num_bdmv_dir
+    // num_bdmv_dir
     data[17] = 1;
     // flags
     data[18] = 0;

tests/disc_tests.rs

@@ -1,7 +1,7 @@
 //! Disc scanning pipeline tests.
 
-use libfreemkv::error::Result;
 use libfreemkv::SectorReader;
+use libfreemkv::error::Result;
 use libfreemkv::{Disc, DiscTitle, ScanOptions};
 use std::collections::HashMap;
 
@@ -21,7 +21,13 @@ impl MockSectorReader {
 }
 
 impl SectorReader for MockSectorReader {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
         let total = count as usize * SECTOR_SIZE;
         for i in 0..count as u32 {
             let offset = i as usize * SECTOR_SIZE;
@@ -127,7 +133,9 @@ fn scan_options_default() {
 
 #[test]
 fn scan_options_with_keydb() {
-    let opts = ScanOptions::with_keydb("/tmp/KEYDB.cfg");
+    let opts = ScanOptions {
+        keydb_path: Some(("/tmp/KEYDB.cfg").into()),
+    };
     assert_eq!(
         opts.keydb_path.as_ref().unwrap().to_str().unwrap(),
         "/tmp/KEYDB.cfg"
@@ -137,7 +145,9 @@ fn scan_options_with_keydb() {
 #[test]
 fn scan_options_with_keydb_pathbuf() {
     let path = std::path::PathBuf::from("/home/user/.config/aacs/KEYDB.cfg");
-    let opts = ScanOptions::with_keydb(path.clone());
+    let opts = ScanOptions {
+        keydb_path: Some(path.clone()),
+    };
     assert_eq!(opts.keydb_path.unwrap(), path);
 }
 
@@ -505,7 +515,9 @@ fn resolve_encryption_no_keydb() {
     build_udf_with_aacs_dir(&mut reader);
 
     // No keydb configured and no standard keydb on the system
-    let opts = ScanOptions::with_keydb("/nonexistent/path/KEYDB.cfg");
+    let opts = ScanOptions {
+        keydb_path: Some(("/nonexistent/path/KEYDB.cfg").into()),
+    };
     let disc = Disc::scan_image(&mut reader, 1000, &opts).unwrap();
 
     // The disc detects encryption but can't resolve keys without a keydb

tests/integration_progress_and_halt.rs

@@ -0,0 +1,539 @@
+//! Integration tests for progress reporting, halt behavior, drop safety,
+//! and the file-backed sector reader round trip.
+
+use libfreemkv::disc::{CopyOptions, DiscRegion};
+use libfreemkv::error::Result;
+use libfreemkv::pes::Stream as PesStream;
+use libfreemkv::{
+    ContentFormat, Disc, DiscFormat, DiscStream, DiscTitle, EventKind, Extent, FileSectorReader,
+    SectorReader,
+};
+use std::io::Write;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::time::{Duration, Instant};
+
+const SECTOR_SIZE: usize = 2048;
+
+// ── helpers ────────────────────────────────────────────────────────────────
+
+/// Returns zeroed sectors. Always succeeds. Counts each call.
+struct ZeroSectorReader {
+    capacity: u32,
+    calls: Arc<AtomicU64>,
+}
+
+impl ZeroSectorReader {
+    fn new(capacity: u32) -> Self {
+        Self {
+            capacity,
+            calls: Arc::new(AtomicU64::new(0)),
+        }
+    }
+}
+
+impl SectorReader for ZeroSectorReader {
+    fn read_sectors(
+        &mut self,
+        _lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
+        self.calls.fetch_add(1, Ordering::Relaxed);
+        let bytes = count as usize * SECTOR_SIZE;
+        buf[..bytes].fill(0);
+        Ok(bytes)
+    }
+
+    fn capacity(&self) -> u32 {
+        self.capacity
+    }
+}
+
+/// Like ZeroSectorReader but sleeps a configurable duration per call.
+/// Used by the halt test so the copy takes >1 s.
+struct SlowZeroSectorReader {
+    capacity: u32,
+    sleep_per_call: Duration,
+}
+
+impl SlowZeroSectorReader {
+    fn new(capacity: u32, sleep_per_call: Duration) -> Self {
+        Self {
+            capacity,
+            sleep_per_call,
+        }
+    }
+}
+
+impl SectorReader for SlowZeroSectorReader {
+    fn read_sectors(
+        &mut self,
+        _lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
+        std::thread::sleep(self.sleep_per_call);
+        let bytes = count as usize * SECTOR_SIZE;
+        buf[..bytes].fill(0);
+        Ok(bytes)
+    }
+
+    fn capacity(&self) -> u32 {
+        self.capacity
+    }
+}
+
+/// Build a Disc instance with a known capacity, no titles, no encryption.
+/// Sufficient for `Disc::copy` (which only uses capacity_sectors + decrypt keys).
+fn synthetic_disc(capacity_sectors: u32) -> Disc {
+    Disc {
+        volume_id: String::new(),
+        meta_title: None,
+        format: DiscFormat::BluRay,
+        capacity_sectors,
+        capacity_bytes: capacity_sectors as u64 * SECTOR_SIZE as u64,
+        layers: 1,
+        titles: Vec::new(),
+        region: DiscRegion::Free,
+        aacs: None,
+        css: None,
+        encrypted: false,
+        content_format: ContentFormat::BdTs,
+    }
+}
+
+/// Build a DiscTitle with a single extent of `sector_count` sectors and no
+/// streams (DiscStream still iterates sectors and would emit BytesRead).
+fn synthetic_title(sector_count: u32) -> DiscTitle {
+    DiscTitle {
+        playlist: String::new(),
+        playlist_id: 0,
+        duration_secs: 0.0,
+        size_bytes: sector_count as u64 * SECTOR_SIZE as u64,
+        clips: Vec::new(),
+        streams: Vec::new(),
+        chapters: Vec::new(),
+        extents: vec![Extent {
+            start_lba: 0,
+            sector_count,
+        }],
+        content_format: ContentFormat::BdTs,
+        codec_privates: Vec::new(),
+    }
+}
+
+// ── 1. BytesRead events emitted during disc copy (TDD red) ────────────────
+
+#[test]
+fn test_bytes_read_emitted_during_disc_copy() {
+    // Build a tiny synthetic disc and stream it through DiscStream.
+    let reader = ZeroSectorReader::new(64);
+    let title = synthetic_title(64);
+    let keys = libfreemkv::DecryptKeys::None;
+
+    let mut stream = DiscStream::new(Box::new(reader), title, keys, 60, ContentFormat::BdTs);
+
+    let count = Arc::new(AtomicU64::new(0));
+    let count_cb = count.clone();
+    stream.on_event(move |ev| {
+        if let EventKind::BytesRead { .. } = ev.kind {
+            count_cb.fetch_add(1, Ordering::Relaxed);
+        }
+    });
+
+    // Drive the stream to EOF. With no streams configured, read() returns
+    // Ok(None) once all extents are exhausted.
+    loop {
+        match stream.read() {
+            Ok(Some(_frame)) => {}
+            Ok(None) => break,
+            Err(e) => panic!("stream read failed: {e:?}"),
+        }
+    }
+
+    let n = count.load(Ordering::Relaxed);
+    // EXPECTED TO FAIL until BytesRead emission is wired up. TDD red.
+    assert!(
+        n > 0,
+        "expected at least one BytesRead event, got {n} (lib does not yet emit BytesRead)"
+    );
+}
+
+// ── 2. Disc::copy on_progress callback fires (regression guard) ───────────
+
+#[test]
+fn test_disc_copy_progress_callback_fires() {
+    let disc = synthetic_disc(64);
+    let mut reader = ZeroSectorReader::new(64);
+
+    let tmp = tempfile::NamedTempFile::new().expect("tempfile create");
+    let iso_path = tmp.path().to_path_buf();
+    drop(tmp); // we want the path, not the file handle
+
+    let calls = Arc::new(AtomicU64::new(0));
+    let last_bytes = Arc::new(AtomicU64::new(0));
+
+    struct CountingReporter {
+        calls: Arc<AtomicU64>,
+        last_bytes: Arc<AtomicU64>,
+    }
+    impl libfreemkv::progress::Progress for CountingReporter {
+        fn report(&self, p: &libfreemkv::progress::PassProgress) {
+            self.calls.fetch_add(1, Ordering::Relaxed);
+            self.last_bytes.store(p.bytes_good_total, Ordering::Relaxed);
+        }
+    }
+    let reporter = CountingReporter {
+        calls: calls.clone(),
+        last_bytes: last_bytes.clone(),
+    };
+
+    let opts = CopyOptions {
+        decrypt: false,
+        progress: Some(&reporter),
+        ..Default::default()
+    };
+
+    let result = disc.copy(&mut reader, &iso_path, &opts).expect("copy ok");
+
+    // Cleanup any sidecar mapfile + ISO before assertions.
+    let _ = std::fs::remove_file(&iso_path);
+    let _ = std::fs::remove_file(libfreemkv::disc::mapfile_path_for(&iso_path));
+
+    assert!(result.complete, "copy should be complete");
+    let n = calls.load(Ordering::Relaxed);
+    let last = last_bytes.load(Ordering::Relaxed);
+    assert!(n > 0, "on_progress should fire at least once, got {n}");
+    assert!(
+        last > 0,
+        "final progress bytes should be non-zero, got {last}"
+    );
+}
+
+// ── 3. Halt aborts disc copy promptly ─────────────────────────────────────
+
+#[test]
+fn test_halt_aborts_disc_copy_promptly() {
+    // 6000 sectors, 60-sector batches → 100 read_sectors() calls.
+    // 10 ms sleep per call → ~1 s total without halt.
+    let capacity_sectors: u32 = 6000;
+    let mut reader = SlowZeroSectorReader::new(capacity_sectors, Duration::from_millis(10));
+    let disc = synthetic_disc(capacity_sectors);
+
+    let tmp = tempfile::NamedTempFile::new().expect("tempfile create");
+    let iso_path = tmp.path().to_path_buf();
+    drop(tmp);
+
+    let halt = Arc::new(AtomicBool::new(false));
+    let halt_for_thread = halt.clone();
+    let iso_path_for_thread = iso_path.clone();
+
+    let join = std::thread::spawn(move || {
+        let opts = CopyOptions {
+            decrypt: false,
+            halt: Some(halt_for_thread),
+            ..Default::default()
+        };
+        let t0 = Instant::now();
+        let res = disc.copy(&mut reader, &iso_path_for_thread, &opts);
+        (res, t0.elapsed())
+    });
+
+    // Let copy run, then halt.
+    std::thread::sleep(Duration::from_millis(200));
+    halt.store(true, Ordering::Relaxed);
+
+    // Bound the join: should exit far before the full 1 s otherwise needed.
+    let started = Instant::now();
+    let mut joined = None;
+    while started.elapsed() < Duration::from_millis(2000) {
+        if join.is_finished() {
+            joined = Some(join.join().expect("thread join"));
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    let (result, elapsed) = joined.expect("copy thread did not exit within 2s of halt");
+
+    // Cleanup
+    let _ = std::fs::remove_file(&iso_path);
+    let _ = std::fs::remove_file(libfreemkv::disc::mapfile_path_for(&iso_path));
+
+    let copy_result = result.expect("copy returns Ok with halted=true on halt");
+    assert!(
+        copy_result.halted,
+        "copy_result.halted should be true after halt"
+    );
+    assert!(
+        !copy_result.complete,
+        "copy_result.complete should be false when halted"
+    );
+    assert!(
+        elapsed < Duration::from_millis(2000),
+        "copy thread exit elapsed {elapsed:?} exceeded 2s"
+    );
+}
+
+// ── 4. DiscStream Drop does not panic or block ────────────────────────────
+
+#[test]
+fn test_drop_impls_do_not_panic_or_block() {
+    let reader = ZeroSectorReader::new(64);
+    let title = synthetic_title(64);
+    let keys = libfreemkv::DecryptKeys::None;
+    let stream = DiscStream::new(Box::new(reader), title, keys, 60, ContentFormat::BdTs);
+
+    // Drop on a worker thread; main thread enforces the timeout.
+    let handle = std::thread::spawn(move || {
+        drop(stream);
+    });
+
+    let started = Instant::now();
+    while started.elapsed() < Duration::from_millis(100) {
+        if handle.is_finished() {
+            handle.join().expect("drop thread join");
+            return;
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    panic!("DiscStream drop did not complete within 100ms");
+}
+
+// ── 5. FileSectorReader round trip ────────────────────────────────────────
+
+#[test]
+fn test_file_sector_reader_round_trip() {
+    // Build 8 sectors of pseudo-random bytes (sector-aligned).
+    const N_SECTORS: usize = 8;
+    let mut data = vec![0u8; N_SECTORS * SECTOR_SIZE];
+    for (i, b) in data.iter_mut().enumerate() {
+        // Cheap PRNG: just a multiplicative pattern, deterministic for asserts.
+        *b = ((i as u64).wrapping_mul(2654435761) >> 16) as u8;
+    }
+
+    let mut tmp = tempfile::NamedTempFile::new().expect("tempfile create");
+    tmp.write_all(&data).expect("write data");
+    tmp.flush().expect("flush");
+
+    let path = tmp.path().to_str().expect("path utf-8").to_string();
+    let mut fsr = FileSectorReader::open(&path).expect("open FileSectorReader");
+
+    assert_eq!(fsr.capacity(), N_SECTORS as u32, "capacity mismatch");
+
+    // Read each sector individually and compare.
+    let mut buf = vec![0u8; SECTOR_SIZE];
+    for lba in 0..N_SECTORS as u32 {
+        let n = fsr
+            .read_sectors(lba, 1, &mut buf, false)
+            .expect("read_sectors");
+        assert_eq!(n, SECTOR_SIZE);
+        let off = lba as usize * SECTOR_SIZE;
+        assert_eq!(
+            &buf[..],
+            &data[off..off + SECTOR_SIZE],
+            "sector {lba} mismatch"
+        );
+    }
+
+    // Read all sectors at once and compare.
+    let mut all = vec![0u8; N_SECTORS * SECTOR_SIZE];
+    let n = fsr
+        .read_sectors(0, N_SECTORS as u16, &mut all, false)
+        .expect("read all sectors");
+    assert_eq!(n, N_SECTORS * SECTOR_SIZE);
+    assert_eq!(all, data, "bulk read mismatch");
+}
+
+// ── 6. Pass 1 sweeps the entire disc even when every read fails ───────────
+//
+// Per RIP_DESIGN.md §2.1 + §3: Disc::copy must reach the end of the disc
+// regardless of how many reads fail. The only legitimate early exit is the
+// halt flag. With `skip_on_error + skip_forward` and a reader that returns
+// Err for every read, Pass 1 must:
+//   - mark every sector NonTrimmed (so Pass 2 can retry them)
+//   - return cleanly (no panic, no hang)
+//   - bytes_good = 0
+//   - bytes_pending = total_bytes (NonTrimmed counts as pending in mapfile
+//     accounting; see disc/mapfile.rs::stats)
+//   - bytes_unreadable = 0 (only Pass 2 marks Unreadable)
+//   - complete = false (work remains for Pass 2)
+//   - halted = false (no user stop)
+//   - ISO file is `total_bytes` size on disk (sparse zeros)
+
+/// Reader that returns Err for every read. Optionally signals a halt
+/// flag on the first read so tests can exercise the halt-during-skip-forward
+/// path deterministically (no wallclock dependency).
+struct FailingSectorReader {
+    capacity: u32,
+    /// If set, signals halt on the first `read_sectors` call. Cleared after
+    /// the first signal so subsequent reads are plain Err.
+    halt_on_first_read: Option<Arc<AtomicBool>>,
+}
+
+impl FailingSectorReader {
+    fn new(capacity: u32) -> Self {
+        Self {
+            capacity,
+            halt_on_first_read: None,
+        }
+    }
+
+    fn with_halt_on_first_read(capacity: u32, halt: Arc<AtomicBool>) -> Self {
+        Self {
+            capacity,
+            halt_on_first_read: Some(halt),
+        }
+    }
+}
+
+impl SectorReader for FailingSectorReader {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        _count: u16,
+        _buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
+        if let Some(h) = self.halt_on_first_read.take() {
+            h.store(true, Ordering::Relaxed);
+        }
+        Err(libfreemkv::error::Error::DiscRead { sector: lba as u64 })
+    }
+
+    fn capacity(&self) -> u32 {
+        self.capacity
+    }
+}
+
+#[test]
+fn test_disc_copy_completes_full_disc_with_failing_reader() {
+    // 1024 sectors = 2 MB. Reader fails every read. With skip_on_error +
+    // skip_forward, Pass 1 must mark every sector NonTrimmed and return
+    // cleanly — no bail, no hang.
+    let capacity_sectors: u32 = 1024;
+    let total_bytes: u64 = capacity_sectors as u64 * SECTOR_SIZE as u64;
+
+    let mut reader = FailingSectorReader::new(capacity_sectors);
+    let disc = synthetic_disc(capacity_sectors);
+
+    let tmp = tempfile::NamedTempFile::new().expect("tempfile create");
+    let iso_path = tmp.path().to_path_buf();
+    drop(tmp);
+
+    let opts = CopyOptions {
+        decrypt: false,
+        skip_on_error: true,
+        skip_forward: true,
+        ..Default::default()
+    };
+
+    let t0 = Instant::now();
+    let result = disc
+        .copy(&mut reader, &iso_path, &opts)
+        .expect("copy returns Ok");
+    let elapsed = t0.elapsed();
+
+    // Cleanup
+    let _ = std::fs::remove_file(&iso_path);
+    let _ = std::fs::remove_file(libfreemkv::disc::mapfile_path_for(&iso_path));
+
+    // Hard bound — even at 0 ms per read, 1024 sectors with skip-forward
+    // should complete in well under a second on any host. If this test runs
+    // for minutes, something has regressed (e.g. stall guard reintroduced
+    // with infinite-loop semantics, or Pass 1 is hanging on each read).
+    assert!(
+        elapsed < Duration::from_secs(5),
+        "Pass 1 took {elapsed:?} on a 2 MB synthetic disc — expected < 5 s"
+    );
+
+    // Per RIP_DESIGN.md §2.1: Pass 1 must reach end of disc regardless of
+    // read outcomes.
+    assert_eq!(
+        result.bytes_total, total_bytes,
+        "bytes_total must match disc capacity"
+    );
+    assert_eq!(
+        result.bytes_good, 0,
+        "no reads succeeded, bytes_good must be 0"
+    );
+    assert_eq!(
+        result.bytes_unreadable, 0,
+        "Pass 1 does not mark Unreadable; only Pass 2 (Disc::patch) does"
+    );
+    assert_eq!(
+        result.bytes_pending, total_bytes,
+        "every sector must be NonTrimmed → counted as pending. \
+         Got bytes_pending={} of total {}",
+        result.bytes_pending, total_bytes
+    );
+    assert!(
+        !result.complete,
+        "complete=false because NonTrimmed regions remain (work for Pass 2)"
+    );
+    assert!(!result.halted, "no halt was set; halted must be false");
+
+    // ISO file should be the full disc size on disk (sparse zeros where
+    // reads failed).
+    // Note: tempfile was dropped above; the file may or may not still exist
+    // depending on cleanup ordering. We only assert what we can observe in
+    // the CopyResult.
+}
+
+// ── 7. Halt during Pass 1 skip-forward path returns promptly (deterministic) ─
+//
+// Per RIP_DESIGN.md §3: halt is the only legitimate early exit from Pass 1.
+// Even when every read is failing (skip-forward path), a halt must be
+// honored within a small bounded time.
+//
+// Deterministic fixture: the reader signals halt on its FIRST read. The
+// inner copy loop's halt check fires on the next iteration, breaking out
+// of 'outer. This avoids any wallclock race on fast CI runners (where a
+// 2 GB synthetic disc can sweep skip-forward in <100 ms).
+
+#[test]
+fn test_disc_copy_halts_promptly_on_failing_reader() {
+    let capacity_sectors: u32 = 1024 * 1024; // 2 GB synthetic disc
+
+    let halt = Arc::new(AtomicBool::new(false));
+    let mut reader = FailingSectorReader::with_halt_on_first_read(capacity_sectors, halt.clone());
+    let disc = synthetic_disc(capacity_sectors);
+
+    let tmp = tempfile::NamedTempFile::new().expect("tempfile create");
+    let iso_path = tmp.path().to_path_buf();
+    drop(tmp);
+
+    let opts = CopyOptions {
+        decrypt: false,
+        skip_on_error: true,
+        skip_forward: true,
+        halt: Some(halt),
+        ..Default::default()
+    };
+
+    let t0 = Instant::now();
+    let result = disc
+        .copy(&mut reader, &iso_path, &opts)
+        .expect("copy returns Ok on halt");
+    let elapsed = t0.elapsed();
+
+    // Cleanup
+    let _ = std::fs::remove_file(&iso_path);
+    let _ = std::fs::remove_file(libfreemkv::disc::mapfile_path_for(&iso_path));
+
+    assert!(
+        elapsed < Duration::from_secs(2),
+        "halt must return within 2 s; took {elapsed:?}"
+    );
+    assert!(result.halted, "result.halted must be true");
+    assert!(
+        !result.complete,
+        "halted run cannot be complete (bytes_pending > 0 expected)"
+    );
+    assert!(
+        result.bytes_pending > 0,
+        "halt fired before sweep completed; bytes_pending must be > 0"
+    );
+}

tests/streams.rs

@@ -30,6 +30,7 @@ fn sample_disc_title() -> DiscTitle {
                 language: "eng".into(),
                 sample_rate: SampleRate::S48,
                 secondary: false,
+                purpose: libfreemkv::LabelPurpose::Normal,
                 label: "English Atmos".into(),
             }),
             Stream::Audio(AudioStream {
@@ -39,6 +40,7 @@ fn sample_disc_title() -> DiscTitle {
                 language: "fra".into(),
                 sample_rate: SampleRate::S48,
                 secondary: false,
+                purpose: libfreemkv::LabelPurpose::Normal,
                 label: "French".into(),
             }),
             Stream::Subtitle(SubtitleStream {
@@ -46,6 +48,7 @@ fn sample_disc_title() -> DiscTitle {
                 codec: Codec::Pgs,
                 language: "eng".into(),
                 forced: false,
+                qualifier: libfreemkv::LabelQualifier::None,
                 codec_data: None,
             }),
         ],
@@ -404,6 +407,7 @@ fn meta_codec_roundtrip() {
             language: "eng".into(),
             sample_rate: SampleRate::S48,
             secondary: false,
+            purpose: libfreemkv::LabelPurpose::Normal,
             label: String::new(),
         }));
     }
@@ -413,6 +417,7 @@ fn meta_codec_roundtrip() {
             codec,
             language: "eng".into(),
             forced: false,
+            qualifier: libfreemkv::LabelQualifier::None,
             codec_data: None,
         }));
     }
@@ -501,6 +506,7 @@ fn meta_all_stream_types() {
                 language: "eng".into(),
                 sample_rate: SampleRate::S48,
                 secondary: false,
+                purpose: libfreemkv::LabelPurpose::Normal,
                 label: "Primary Audio".into(),
             }),
             Stream::Subtitle(SubtitleStream {
@@ -508,6 +514,7 @@ fn meta_all_stream_types() {
                 codec: Codec::Pgs,
                 language: "fra".into(),
                 forced: true,
+                qualifier: libfreemkv::LabelQualifier::None,
                 codec_data: None,
             }),
             Stream::Audio(AudioStream {
@@ -517,6 +524,7 @@ fn meta_all_stream_types() {
                 language: "eng".into(),
                 sample_rate: SampleRate::S48,
                 secondary: true,
+                purpose: libfreemkv::LabelPurpose::Normal,
                 label: "Commentary".into(),
             }),
         ],
@@ -623,6 +631,7 @@ fn mkvstream_roundtrip_bdts() {
             language: "eng".into(),
             sample_rate: SampleRate::S48,
             secondary: false,
+            purpose: libfreemkv::LabelPurpose::Normal,
             label: "English".into(),
         })],
         chapters: Vec::new(),
@@ -679,6 +688,7 @@ fn mkvstream_meta_preserves_all_streams() {
                 language: "eng".into(),
                 sample_rate: SampleRate::S48,
                 secondary: false,
+                purpose: libfreemkv::LabelPurpose::Normal,
                 label: "English".into(),
             }),
             Stream::Audio(AudioStream {
@@ -688,6 +698,7 @@ fn mkvstream_meta_preserves_all_streams() {
                 language: "fra".into(),
                 sample_rate: SampleRate::S48,
                 secondary: false,
+                purpose: libfreemkv::LabelPurpose::Normal,
                 label: "French".into(),
             }),
             Stream::Subtitle(SubtitleStream {
@@ -695,6 +706,7 @@ fn mkvstream_meta_preserves_all_streams() {
                 codec: Codec::Pgs,
                 language: "eng".into(),
                 forced: false,
+                qualifier: libfreemkv::LabelQualifier::None,
                 codec_data: None,
             }),
             Stream::Subtitle(SubtitleStream {
@@ -702,6 +714,7 @@ fn mkvstream_meta_preserves_all_streams() {
                 codec: Codec::Pgs,
                 language: "fra".into(),
                 forced: true,
+                qualifier: libfreemkv::LabelQualifier::None,
                 codec_data: None,
             }),
         ],

tests/udf_tests.rs

@@ -1,7 +1,7 @@
 //! UDF parser tests using a MockSectorReader.
 
 use libfreemkv::error::Result;
-use libfreemkv::{read_filesystem, SectorReader};
+use libfreemkv::{SectorReader, read_filesystem};
 use std::collections::HashMap;
 
 const SECTOR_SIZE: usize = 2048;
@@ -39,7 +39,13 @@ impl MockSectorReader {
 }
 
 impl SectorReader for MockSectorReader {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8]) -> Result<usize> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
         let total = count as usize * SECTOR_SIZE;
         assert!(buf.len() >= total, "buffer too small");
         for i in 0..count as u32 {
@@ -215,7 +221,7 @@ fn mock_sector_reader_roundtrip() {
 
     // Read it back
     let mut buf = vec![0u8; SECTOR_SIZE];
-    let n = reader.read_sectors(100, 1, &mut buf).unwrap();
+    let n = reader.read_sectors(100, 1, &mut buf, true).unwrap();
     assert_eq!(n, SECTOR_SIZE);
     assert_eq!(buf[0], 0xAB);
     assert_eq!(buf[1], 0xCD);
@@ -223,7 +229,7 @@ fn mock_sector_reader_roundtrip() {
 
     // Reading an unmapped sector returns zeros
     let mut buf2 = vec![0xFFu8; SECTOR_SIZE];
-    let n2 = reader.read_sectors(999, 1, &mut buf2).unwrap();
+    let n2 = reader.read_sectors(999, 1, &mut buf2, true).unwrap();
     assert_eq!(n2, SECTOR_SIZE);
     assert_eq!(buf2[0], 0);
     assert_eq!(buf2[2047], 0);
@@ -243,7 +249,7 @@ fn mock_sector_reader_multi_sector() {
 
     // Read 2 consecutive sectors
     let mut buf = vec![0u8; SECTOR_SIZE * 2];
-    let n = reader.read_sectors(10, 2, &mut buf).unwrap();
+    let n = reader.read_sectors(10, 2, &mut buf, true).unwrap();
     assert_eq!(n, SECTOR_SIZE * 2);
     assert_eq!(buf[0], 10);
     assert_eq!(buf[SECTOR_SIZE], 11);
@@ -463,7 +469,7 @@ fn sector_reader_is_object_safe() {
 
     let dyn_reader: &mut dyn SectorReader = &mut reader;
     let mut buf = vec![0u8; SECTOR_SIZE];
-    let n = dyn_reader.read_sectors(0, 1, &mut buf).unwrap();
+    let n = dyn_reader.read_sectors(0, 1, &mut buf, true).unwrap();
     assert_eq!(n, SECTOR_SIZE);
     assert_eq!(buf[0], 42);
 }