v0.12.2: hide halt behind checked_sleep / checked_exec primitives

Drive::read is now halt-check-free in its body. Previously, the halt flag was checked in 4 places and the sleep logic was scattered across 4 "if halt_aware_sleep { return Halted }" call sites — correct, but the ugliness invited drift: a new sleep added by someone unfamiliar with the pattern would silently swallow Stop requests. Two private primitives now own halt awareness: checked_sleep(Duration) -> Result<()> checked_exec(cdb, dir, buf, timeout_ms) -> Result<ScsiResult> Both return Err(Halted) instead of a bool. The ? operator in read() then propagates halts for free. The recovery path reads top-to-bottom with no halt vocabulary. sleep_until_halted lives as a free function so it's unit-testable without a live Drive. 4 new tests: completes normally, bails on pre-set flag within one slice, wakes mid-sleep, zero-duration no-op. Public API unchanged — halt_flag/halt/clear_halt still exposed, the refactor is entirely internal.
v0.12.1: halt-aware sleeps in Drive::read recovery
2026-10-07 18:13:10 +00:00 · 2026-04-24 13:12:24 -07:00 · 2026-04-24 12:59:36 -07:00 · 2026-04-24 12:57:53 -07:00 · 2026-04-24 12:23:42 -07:00 · 2026-04-24 12:21:43 -07:00
43 changed files with 1394 additions and 296 deletions
@@ -1,5 +1,67 @@
 # Changelog

+## 0.12.0 (2026-04-24)
+
+### Rust 2024 edition migration
+- Bumped `edition = "2024"`. Required code changes:
+  - FFI declarations in `src/scsi/macos.rs` wrapped in `unsafe extern "C" { … }` per the 2024 FFI safety rules.
+  - `unsafe_op_in_unsafe_fn` lint: `vtable_fn()` body now has an explicit `unsafe { … }` block rather than relying on implicit unsafe of the containing `unsafe fn`.
+  - Match-ergonomics: removed redundant `ref`/`ref mut` bindings in `mux/meta.rs`, `mux/mkvstream.rs`, `mux/network.rs`, `mux/stdio.rs` — 2024 tightens "cannot explicitly borrow within an implicitly-borrowing pattern."
+- No behavior change. MSRV stays at 1.86.
+
+### Minor / version sync
+- Part of the 0.12.0 ecosystem release. The autorip-side fixes (progress regressions, UI redesign, regression-guard tests) drove the minor bump.
+
+## 0.11.22 (2026-04-24)
+
+### Version sync — no functional changes
+Part of the 0.11.22 ecosystem release. autorip 0.11.22 ships full multi-pass UI (bad-range viz, live mapfile stats, Recovery settings); the library API is unchanged from 0.11.21.
+
+## 0.11.21 (2026-04-24)
+
+### Multi-pass rip architecture — disc → ISO → patch → ISO
+
+New primitives for two-stage rip: fast forward pass with zero-fill on failures, then targeted retries of bad ranges. Keeps the library API stream-based; the multi-pass model lives entirely in caller-orchestrated function composition.
+
+- **New `Disc::copy(reader, path, &CopyOptions)`** replaces the positional-arg version. Always produces a ddrescue-format mapfile at `path + ".mapfile"` as a side-effect. With `skip_on_error=true` + `skip_forward=true`, does ddrescue-style fast sweep: 64 KB block reads, exponential skip-forward (256 KB → cap at 1% of disc) on failure, zero-fill bad blocks, record ranges in the mapfile. With defaults (both false), matches pre-0.11.21 behavior — uses drive-level recovery, aborts on bad sector. Mapfile is produced either way.
+- **New `Disc::patch(reader, path, &PatchOptions)`** — idempotent retry pass. Reads the mapfile, re-reads every non-`+` range with full drive recovery enabled, writes successful bytes back into the ISO at exact offsets, updates mapfile. Call N times for N retry attempts.
+- **New `disc::mapfile` module** — ddrescue-compatible plain-text format. Crash-safe (flushes on every `record()`), greppable, human-editable, tool-interoperable. Status chars match ddrescue: `?` non-tried · `*` non-trimmed · `/` non-scraped · `-` unreadable · `+` finished.
+- **Re-exports:** `FileSectorReader` from the crate root for ISO readers.
+
+### Breaking changes
+- `Disc::copy`'s signature changes from positional args (`decrypt, resume, batch, on_progress`) to `CopyOptions`. Previous callers must migrate. `freemkv` CLI updated in lockstep.
+
+### Version sync
+- Part of the 0.11.21 ecosystem release (libfreemkv + freemkv + bdemu + autorip all on 0.11.21).
+
+## 0.11.18 (2026-04-24)
+
+### DiscStream halt flag — Stop works during dense bad-sector regions
+
+`DiscStream::fill_extents` loops internally when the demuxer hasn't accumulated enough data to emit a PES frame — during a dense bad-sector run, that loop can spend many minutes shrinking batch sizes and zero-filling sectors without ever returning to the outer read() call. Without an internal halt check, the caller's Stop request goes unserviced until the demuxer eventually emits a frame, which may be very far away.
+
+- **`DiscStream::set_halt(Arc<AtomicBool>)`** — share a halt flag with the stream. Typically wired to `Drive::halt_flag()` so Stop propagates across both the drive's recovery phases and the stream's sector processing.
+- **`fill_extents()` checks the halt flag** at the top of every retry iteration (before each attempt at every size level). Raising the flag aborts within one read round-trip — at most the current SCSI command's timeout.
+- Returns `Err(Error::Halted)` (E6010) so the outer rip pipeline terminates cleanly.
+
+No behavior change for callers that don't call `set_halt`. Unblocks the architectural fix for the "Stop doesn't stop" bug observed on a damaged UHD disc where the stream was stuck in a 12+ hour bad-sector grind.
+
+## 0.11.17 (2026-04-23)
+
+### Adaptive batch sizer in DiscStream — no more per-sector descent
+
+Rip recovery rewritten. The old binary-search-per-bad-sector model paid the full descent (batch → half → quarter → … → single) for every bad sector in a region. On a damaged disc with 600 consecutive bad sectors this took 12+ hours. The new algorithm pays the descent once, remembers the working size, and ramps back up only after a sustained clean streak.
+
+- **`BatchSizeChanged { new_size, reason }` event** — fires on shrink (read failed) and probe-up (clean streak threshold hit). Consumers use this to distinguish a "recovering" rip from a normal one.
+- **Removed `BinarySearch` and `SectorRecovered` emissions from DiscStream** — no longer produced by the rip path. `SectorRecovered` still fires from `Drive::read`'s multi-phase recovery (unused by rips today, but kept for scan/other callers).
+- **Removed `read_with_binary_search` and the 3×5s light-recovery loop** — no retry loops, no sleeps. One 5s attempt per read. On size-1 failure, skip (zero-fill) or error.
+- **Probe-up threshold: 100 MiB (51,200 sectors) of clean reading at current size** before doubling toward preferred. Ramp 1 → preferred on good reading takes ~100 seconds for a typical BD — trivial vs. rip duration, conservative enough that a single lucky sector in a marginal zone can't trigger a premature probe.
+- **Bad-region math**: ~600 consecutive bad sectors now complete in ~50 min (600 × 5s) instead of ~12h. The descent is O(log preferred) one time, not per sector.
+
+### macOS
+
+- Fix new clippy lint (`manual_c_str_literals`) in `scsi/macos.rs`.
+
 ## 0.11.16 (2026-04-21)

 ### API cleanup — one method per action
@@ -1,7 +1,7 @@
 [package]
 name = "libfreemkv"
-version = "0.11.16"
-edition = "2021"
+version = "0.12.2"
+edition = "2024"
 rust-version = "1.86"
 license = "AGPL-3.0-only"
 description = "Open source raw disc access library for optical drives"
@@ -51,6 +51,31 @@ while let Ok(Some(frame)) = input.read() {
 output.finish()?;
 ```

+### Multi-pass recovery rip
+
+For damaged discs, the library offers a two-stage rip model: fast sweep with zero-fill and a ddrescue-format mapfile, then targeted retry of bad ranges. See [`docs/rip-recovery.md`](docs/rip-recovery.md) for the full architecture.
+
+```rust
+use libfreemkv::disc::{CopyOptions, PatchOptions};
+
+// Pass 1: disc → ISO. Fast 64 KB reads, skip-forward on failure,
+// zero-fill bad blocks, write a sidecar .mapfile.
+let mut result = disc.copy(
+    &mut drive,
+    Path::new("disc.iso"),
+    &CopyOptions { skip_on_error: true, skip_forward: true, ..Default::default() },
+)?;
+
+// Pass 2..N: retry bad ranges with full drive recovery.
+// Idempotent — call as many times as you want.
+while result.bytes_unreadable + result.bytes_pending > 0 {
+    let pr = disc.patch(&mut drive, Path::new("disc.iso"), &PatchOptions::default())?;
+    if pr.bytes_recovered_this_pass == 0 { break; }
+}
+
+// Then mux from the ISO via the normal stream pipeline (no drive involvement).
+```
+
 ## What It Does

 - **Drive access** — open, identify, unlock, firmware upload, speed calibration, eject
@@ -0,0 +1,127 @@
+# Rip recovery — multi-pass architecture
+
+`libfreemkv` supports a two-stage rip model for damaged or protection-bearing
+discs: a fast forward sweep that tolerates read failures, followed by targeted
+retry passes against a persistent bad-range map. The stream pipeline
+(`DiscStream` + `input`/`output`) operates against the resulting ISO image, so
+the mux stage never touches the drive.
+
+Three primitives compose the flow:
+
+| Primitive                 | What it does                                                          |
+|---------------------------|-----------------------------------------------------------------------|
+| `Disc::copy`              | disc → ISO. Writes a sidecar `.mapfile`. Opt-in skip-forward on failure. |
+| `Disc::patch`             | Re-reads bad ranges from the drive. Idempotent; call N times.         |
+| `DiscStream` (ISO source) | Reads sectors from the ISO, feeds decrypt → demux → codec → mux.      |
+
+The caller orchestrates. Autorip's `rip_disc` loops `copy` then N × `patch` per
+the `MAX_RETRIES` config, then hands the ISO off to the existing mux pipeline.
+
+## Data model
+
+### Mapfile
+
+Format: [ddrescue](https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html)-compatible
+plain text, greppable, tool-interoperable. Flushed to disk on every `record()`
+so a crashed rip loses at most one block.
+
+```
+# Rescue Logfile. Created by libfreemkv v0.11.22
+# Current pos / status / pass / pass_time
+0x000000000  ?  1  0
+#      pos        size  status
+0x000000000  0x12a35d000    +
+0x12a35d000  0x000003000    -
+0x12a360000  0x009c4a000    +
+0x12d00a000  0x000064000    *
+```
+
+Status characters match ddrescue:
+
+| Char | Meaning                                            |
+|------|----------------------------------------------------|
+| `?`  | Not yet attempted                                  |
+| `*`  | Fast-pass failed; needs edge-trim                  |
+| `/`  | Trimmed; interior needs sector scrape              |
+| `-`  | Unreadable this session                            |
+| `+`  | Finished (good)                                    |
+
+Position and size are hex byte offsets into the ISO.
+
+### `CopyOptions` and `PatchOptions`
+
+Defaults preserve pre-`0.11.21` behavior — full drive recovery on every read,
+abort on the first unreadable sector. Opt in to the recovery-friendly path:
+
+```rust
+CopyOptions {
+    skip_on_error: true,   // zero-fill bad blocks, continue
+    skip_forward: true,    // exponential skip-forward after a failure
+    resume: true,          // pick up from an existing ISO + mapfile
+    decrypt: false,        // keep the ISO a raw disc image
+    ..Default::default()
+}
+```
+
+## Algorithm
+
+### Pass 1 — fast sweep
+
+1. Read 64 KB (32 sectors, one BD ECC block) at the current LBA.
+2. On success: mark the range `+`, advance by one block.
+3. On failure (with `skip_on_error`): zero-fill the block in the ISO, mark
+   it `*`, advance.
+4. If `skip_forward` is set: after a failure, jump ahead by an exponentially
+   growing amount (256 KB initial, doubling on consecutive failures, capped at
+   1% of disc). The skipped bytes are also marked `*` — `patch` will visit
+   them later.
+5. Reset the skip size to 256 KB on the first success after a failure.
+
+Pass 1 completes when every byte has terminal status (`+`, `-`, or the caller
+bails via the halt flag).
+
+### Pass 2+ — patch
+
+`Disc::patch` reads the mapfile and iterates every non-`+` range. For each:
+
+1. Issue a drive read with full recovery enabled (SCSI-level retries,
+   ECC recovery, the lot).
+2. On success: write the good bytes into the ISO at the exact byte offset,
+   mark `+`.
+3. On failure: mark `-`.
+4. Update the mapfile after every block — crash-safe resume.
+
+Idempotent. Call `patch` N times for N retry attempts; typically the caller
+stops early if a pass recovers zero bytes (structure-protected sectors will
+never yield).
+
+## Design choices
+
+**No `MODE SELECT` to disable drive retries.** Research showed neither ddrescue
+nor MakeMKV does this. Drive firmware has access to raw analog signal, laser
+power control, and drive-specific ECC tuning that userspace can't replicate —
+disabling it throws away recovery headroom on marginal sectors. We fail fast
+via short SG_IO timeouts instead, and we avoid per-sector probing on first
+contact by using large blocks + skip-forward.
+
+**ISO intermediate, even for single-pass.** Pass 1 always writes an ISO. The
+mux stage reads the ISO via `IsoSectorReader`. For single-pass (no retries),
+this adds ~2-3 min (local disk mux) but gains resumability across crashes,
+re-muxability without re-ripping, and a persistent forensic artifact. Callers
+who need pure speed can bypass and use `DiscStream::new(Box::new(drive), …)`
+directly — the lib doesn't forbid it.
+
+**Mapfile in ddrescue format.** Plain text so users can `less` it, `diff` it,
+or feed it to ddrescue's own tooling. Crash-safe (flush-per-record). Entries
+coalesce on adjacent same-status ranges so files stay small.
+
+**Patches target `-`, `*`, `/`, and `?` alike.** The status state machine is
+ddrescue's but `patch` collapses the distinction — it just tries every
+non-finished range with full recovery. Future work can specialize (trim vs.
+scrape vs. retry with direction reversal) if there's measured benefit.
+
+## References
+
+- [ddrescue manual, Algorithm chapter](https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html)
+- [ddrescue optical media notes](https://www.electric-spoon.com/doc/gddrescue/html/Optical-media.html)
+- Source: [`src/disc/mapfile.rs`](../src/disc/mapfile.rs), [`src/disc/mod.rs`](../src/disc/mod.rs) (`Disc::copy`, `Disc::patch`)
@@ -1,7 +1,7 @@
 //! AACS content decryption — AES primitives, unit decryption, bus encryption.

-use aes::cipher::{generic_array::GenericArray, BlockDecrypt, BlockEncrypt, KeyInit};
 use aes::Aes128;
+use aes::cipher::{BlockDecrypt, BlockEncrypt, KeyInit, generic_array::GenericArray};

 // ── AACS constants ──────────────────────────────────────────────────────────

@@ -674,8 +674,8 @@ fn generate_host_key_pair() -> ([u8; 20], [u8; 20], [u8; 20]) {

 /// AES-128-CMAC over 16 bytes of data.
 fn aes_cmac_16(data: &[u8; 16], key: &[u8; 16]) -> [u8; 16] {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
    use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};

    let cipher = Aes128::new(GenericArray::from_slice(key));

@@ -361,11 +361,7 @@ mod tests {
    /// Get KEYDB path from KEYDB_PATH environment variable. Returns None if not set or not found.
    fn keydb_path() -> Option<std::path::PathBuf> {
        let path = std::path::PathBuf::from(std::env::var("KEYDB_PATH").ok()?);
-        if path.exists() {
-            Some(path)
-        } else {
-            None
-        }
+        if path.exists() { Some(path) } else { None }
    }

    #[test]
@@ -661,18 +661,14 @@ pub fn resolve_keys(

 #[cfg(test)]
 mod tests {
-    use super::super::decrypt::{aes_ecb_encrypt, ALIGNED_UNIT_LEN};
+    use super::super::decrypt::{ALIGNED_UNIT_LEN, aes_ecb_encrypt};
    use super::super::keydb::{DiscEntry, KeyDb};
    use super::*;

    /// Get KEYDB path from KEYDB_PATH environment variable. Returns None if not set or not found.
    fn keydb_path() -> Option<std::path::PathBuf> {
        let path = std::path::PathBuf::from(std::env::var("KEYDB_PATH").ok()?);
-        if path.exists() {
-            Some(path)
-        } else {
-            None
-        }
+        if path.exists() { Some(path) } else { None }
    }

    #[test]
@@ -849,7 +845,7 @@ mod tests {
        data[23] = 1; // top_menu = CPS unit 1
        data[24] = 0;
        data[25] = 1; // num_titles = 1
-                      // Title 0 entry: 2 bytes pad + CPS unit
+        // Title 0 entry: 2 bytes pad + CPS unit
        data[28] = 0;
        data[29] = 1; // CPS unit 1

@@ -21,12 +21,12 @@ pub mod keys;
 // Explicit re-exports — only items needed by external consumers and sibling crate modules.
 // AES primitives (aes_ecb_encrypt, aes_ecb_decrypt, aes_cbc_decrypt) are pub(crate) in decrypt.rs.
 pub use decrypt::{
-    decrypt_bus, decrypt_unit, decrypt_unit_full, decrypt_unit_try_keys, is_unit_encrypted,
-    ALIGNED_UNIT_LEN,
+    ALIGNED_UNIT_LEN, decrypt_bus, decrypt_unit, decrypt_unit_full, decrypt_unit_try_keys,
+    is_unit_encrypted,
 };
 pub use keydb::{DeviceKey, DiscEntry, HostCert, KeyDb};
 pub use keys::{
-    decrypt_unit_key, derive_media_key_from_dk, derive_media_key_from_pk, derive_vuk, disc_hash,
-    disc_hash_hex, mkb_version, parse_content_cert, parse_unit_key_ro, read_mkb_from_drive,
-    resolve_keys, ContentCert, ResolvedKeys, UnitKeyFile,
+    ContentCert, ResolvedKeys, UnitKeyFile, decrypt_unit_key, derive_media_key_from_dk,
+    derive_media_key_from_pk, derive_vuk, disc_hash, disc_hash_hex, mkb_version,
+    parse_content_cert, parse_unit_key_ro, read_mkb_from_drive, resolve_keys,
 };
@@ -149,7 +149,7 @@ mod tests {
        let key = [0x01, 0x02, 0x03, 0x04, 0x05];
        let mut sector = vec![0xAA; 2048];
        sector[0x14] = 0x30; // scramble flag set
-                             // Set a sector seed
+        // Set a sector seed
        sector[0x54..0x59].copy_from_slice(&[0x11, 0x22, 0x33, 0x44, 0x55]);
        let original = sector.clone();
        descramble_sector(&key, &mut sector);
@@ -0,0 +1,446 @@
+//! ddrescue-compatible mapfile for tracking rip progress.
+//!
+//! Records which byte ranges of a disc image are good, unreadable,
+//! or not-yet-attempted. Written as plain text so it's greppable,
+//! human-editable, and interoperates with ddrescue's own tools.
+//!
+//! Format:
+//! ```text
+//! # Rescue Logfile. Created by libfreemkv v0.11.21
+//! # Current pos / status / pass / pass_time (ddrescue state machine — we only populate pos)
+//! 0x000000000  ?  1  0
+//! #      pos        size  status
+//! 0x000000000  0x12345678    +
+//! 0x012345678  0x00001000    -
+//! 0x012346678  0x01234500    ?
+//! ```
+//!
+//! Status chars: `?` non-tried · `*` non-trimmed · `/` non-scraped · `-` unreadable · `+` finished.
+//!
+//! The mapfile is flushed to disk on every `record()` call so a crashed
+//! rip loses at most one block of recorded state.
+
+use std::io::{self, Write};
+use std::path::{Path, PathBuf};
+
+/// Status of a byte range in the mapfile. ddrescue-compatible.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SectorStatus {
+    /// `?` — not yet attempted. Initial state for a fresh mapfile.
+    NonTried,
+    /// `*` — fast-pass read failed; edges need trimming.
+    NonTrimmed,
+    /// `/` — trimmed; interior needs sector scrape.
+    NonScraped,
+    /// `-` — drive couldn't read it this session.
+    Unreadable,
+    /// `+` — good.
+    Finished,
+}
+
+impl SectorStatus {
+    pub fn to_char(self) -> char {
+        match self {
+            Self::NonTried => '?',
+            Self::NonTrimmed => '*',
+            Self::NonScraped => '/',
+            Self::Unreadable => '-',
+            Self::Finished => '+',
+        }
+    }
+    pub fn from_char(c: char) -> Option<Self> {
+        Some(match c {
+            '?' => Self::NonTried,
+            '*' => Self::NonTrimmed,
+            '/' => Self::NonScraped,
+            '-' => Self::Unreadable,
+            '+' => Self::Finished,
+            _ => return None,
+        })
+    }
+}
+
+/// One contiguous range of bytes with a status.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MapEntry {
+    pub pos: u64,
+    pub size: u64,
+    pub status: SectorStatus,
+}
+
+/// Summary statistics over all entries.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct MapStats {
+    pub bytes_total: u64,
+    pub bytes_good: u64,
+    pub bytes_unreadable: u64,
+    pub bytes_pending: u64,
+}
+
+/// Write-through mapfile. Every `record()` persists to disk immediately
+/// so a crash during rip loses at most one block.
+pub struct Mapfile {
+    path: PathBuf,
+    entries: Vec<MapEntry>,
+    total_size: u64,
+    version: String,
+}
+
+impl Mapfile {
+    /// Create a new mapfile with one `NonTried` region covering the whole disc.
+    /// Writes to disk immediately so a resume can pick up even if the caller
+    /// never records anything.
+    pub fn create(path: &Path, total_size: u64, version: &str) -> io::Result<Self> {
+        let mf = Self {
+            path: path.to_path_buf(),
+            entries: vec![MapEntry {
+                pos: 0,
+                size: total_size,
+                status: SectorStatus::NonTried,
+            }],
+            total_size,
+            version: version.to_string(),
+        };
+        mf.write_to_disk()?;
+        Ok(mf)
+    }
+
+    /// Load an existing mapfile from disk.
+    pub fn load(path: &Path) -> io::Result<Self> {
+        let text = std::fs::read_to_string(path)?;
+        let mut entries = Vec::new();
+        let mut saw_current_line = false;
+        let mut version = String::from("unknown");
+        for line in text.lines() {
+            let t = line.trim();
+            if t.is_empty() {
+                continue;
+            }
+            if let Some(rest) = t.strip_prefix('#') {
+                let rest = rest.trim();
+                if let Some(v) = rest.strip_prefix("Rescue Logfile. Created by ") {
+                    version = v.to_string();
+                }
+                continue;
+            }
+            // First non-comment line is the "current" state line (pos status [pass] [pass_time]).
+            // We ignore its contents but skip over it.
+            if !saw_current_line {
+                saw_current_line = true;
+                // But if the line looks like an entry (has at least 3 fields starting 0x...),
+                // it's probably actually an entry for a mapfile we wrote without a current line.
+                // Heuristic: current line has status char as 2nd field; entry has size as 2nd field.
+                let fields: Vec<&str> = t.split_whitespace().collect();
+                if fields.len() >= 3 && fields[1].starts_with("0x") {
+                    // It's an entry, not a current line — fall through to entry parse.
+                } else {
+                    continue;
+                }
+            }
+            // Entry: `pos size statuschar`
+            let fields: Vec<&str> = t.split_whitespace().collect();
+            if fields.len() < 3 {
+                continue;
+            }
+            let pos = parse_hex(fields[0])?;
+            let size = parse_hex(fields[1])?;
+            let status = fields[2]
+                .chars()
+                .next()
+                .and_then(SectorStatus::from_char)
+                .ok_or_else(|| {
+                    io::Error::new(
+                        io::ErrorKind::InvalidData,
+                        format!("bad status char in mapfile: {}", fields[2]),
+                    )
+                })?;
+            entries.push(MapEntry { pos, size, status });
+        }
+        entries.sort_by_key(|e| e.pos);
+        let total_size = entries.last().map(|e| e.pos + e.size).unwrap_or(0);
+        Ok(Self {
+            path: path.to_path_buf(),
+            entries,
+            total_size,
+            version,
+        })
+    }
+
+    /// Load if the file exists, otherwise create a fresh mapfile.
+    pub fn open_or_create(path: &Path, total_size: u64, version: &str) -> io::Result<Self> {
+        match Self::load(path) {
+            Ok(mf) => Ok(mf),
+            Err(e) if e.kind() == io::ErrorKind::NotFound => {
+                Self::create(path, total_size, version)
+            }
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Mark a byte range as having the given status. Splits any overlapping
+    /// existing entries, merges with adjacent same-status entries, and flushes
+    /// to disk.
+    pub fn record(&mut self, pos: u64, size: u64, status: SectorStatus) -> io::Result<()> {
+        if size == 0 {
+            return Ok(());
+        }
+        let end = pos.saturating_add(size);
+        let mut new_entries = Vec::with_capacity(self.entries.len() + 2);
+
+        for e in self.entries.drain(..) {
+            let e_end = e.pos + e.size;
+            if e_end <= pos || e.pos >= end {
+                // entirely before or after — keep
+                new_entries.push(e);
+                continue;
+            }
+            // Overlap — keep portions outside [pos, end)
+            if e.pos < pos {
+                new_entries.push(MapEntry {
+                    pos: e.pos,
+                    size: pos - e.pos,
+                    status: e.status,
+                });
+            }
+            if e_end > end {
+                new_entries.push(MapEntry {
+                    pos: end,
+                    size: e_end - end,
+                    status: e.status,
+                });
+            }
+        }
+        new_entries.push(MapEntry { pos, size, status });
+        new_entries.sort_by_key(|e| e.pos);
+
+        // Coalesce adjacent same-status entries.
+        let mut merged: Vec<MapEntry> = Vec::with_capacity(new_entries.len());
+        for e in new_entries {
+            if let Some(last) = merged.last_mut() {
+                if last.pos + last.size == e.pos && last.status == e.status {
+                    last.size += e.size;
+                    continue;
+                }
+            }
+            merged.push(e);
+        }
+
+        self.entries = merged;
+        self.write_to_disk()?;
+        Ok(())
+    }
+
+    pub fn entries(&self) -> &[MapEntry] {
+        &self.entries
+    }
+
+    pub fn total_size(&self) -> u64 {
+        self.total_size
+    }
+
+    /// First range with a given status starting at or after `from`.
+    pub fn next_with(&self, from: u64, status: SectorStatus) -> Option<(u64, u64)> {
+        for e in &self.entries {
+            if e.status != status {
+                continue;
+            }
+            let e_end = e.pos + e.size;
+            if e_end <= from {
+                continue;
+            }
+            let start = e.pos.max(from);
+            return Some((start, e_end - start));
+        }
+        None
+    }
+
+    /// All ranges matching one of the given statuses, in position order.
+    pub fn ranges_with(&self, statuses: &[SectorStatus]) -> Vec<(u64, u64)> {
+        self.entries
+            .iter()
+            .filter(|e| statuses.contains(&e.status))
+            .map(|e| (e.pos, e.size))
+            .collect()
+    }
+
+    pub fn stats(&self) -> MapStats {
+        let mut s = MapStats {
+            bytes_total: self.total_size,
+            ..Default::default()
+        };
+        for e in &self.entries {
+            match e.status {
+                SectorStatus::Finished => s.bytes_good += e.size,
+                SectorStatus::Unreadable => s.bytes_unreadable += e.size,
+                SectorStatus::NonTried | SectorStatus::NonTrimmed | SectorStatus::NonScraped => {
+                    s.bytes_pending += e.size
+                }
+            }
+        }
+        s
+    }
+
+    fn write_to_disk(&self) -> io::Result<()> {
+        // Write to a tempfile then rename for atomicity. Appending ".tmp"
+        // rather than `with_extension` so we don't clobber the original
+        // extension (which may already be ".mapfile").
+        let tmp = {
+            let mut s = self.path.clone().into_os_string();
+            s.push(".tmp");
+            PathBuf::from(s)
+        };
+        {
+            let file = std::fs::File::create(&tmp)?;
+            let mut w = std::io::BufWriter::new(file);
+            writeln!(
+                w,
+                "# Rescue Logfile. Created by libfreemkv v{}",
+                self.version
+            )?;
+            writeln!(w, "# Current pos / status / pass / pass_time")?;
+            writeln!(w, "0x000000000  ?  1  0")?;
+            writeln!(w, "#      pos        size  status")?;
+            for e in &self.entries {
+                writeln!(
+                    w,
+                    "0x{:09x}  0x{:09x}    {}",
+                    e.pos,
+                    e.size,
+                    e.status.to_char()
+                )?;
+            }
+            w.flush()?;
+        }
+        std::fs::rename(&tmp, &self.path)?;
+        Ok(())
+    }
+}
+
+fn parse_hex(s: &str) -> io::Result<u64> {
+    let s = s.strip_prefix("0x").unwrap_or(s);
+    u64::from_str_radix(s, 16)
+        .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("bad hex {s}: {e}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tmpfile(tag: &str) -> PathBuf {
+        use std::sync::atomic::{AtomicU64, Ordering};
+        static CTR: AtomicU64 = AtomicU64::new(0);
+        let n = CTR.fetch_add(1, Ordering::Relaxed);
+        let name = format!(
+            "libfreemkv-mapfile-test-{}-{}-{}.mapfile",
+            std::process::id(),
+            tag,
+            n
+        );
+        std::env::temp_dir().join(name)
+    }
+
+    #[test]
+    fn create_has_one_nontried_region() {
+        let p = tmpfile("create_has_one_nontried_region");
+        let _ = std::fs::remove_file(&p);
+        let mf = Mapfile::create(&p, 1000, "test").unwrap();
+        assert_eq!(mf.entries().len(), 1);
+        assert_eq!(mf.entries()[0].pos, 0);
+        assert_eq!(mf.entries()[0].size, 1000);
+        assert_eq!(mf.entries()[0].status, SectorStatus::NonTried);
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn record_splits_overlap() {
+        let p = tmpfile("record_splits_overlap");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(200, 100, SectorStatus::Finished).unwrap();
+        let es = mf.entries();
+        assert_eq!(es.len(), 3);
+        assert_eq!(
+            (es[0].pos, es[0].size, es[0].status),
+            (0, 200, SectorStatus::NonTried)
+        );
+        assert_eq!(
+            (es[1].pos, es[1].size, es[1].status),
+            (200, 100, SectorStatus::Finished)
+        );
+        assert_eq!(
+            (es[2].pos, es[2].size, es[2].status),
+            (300, 700, SectorStatus::NonTried)
+        );
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn record_coalesces_adjacent_same_status() {
+        let p = tmpfile("record_coalesces_adjacent_same_status");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(100, 100, SectorStatus::Finished).unwrap();
+        mf.record(200, 100, SectorStatus::Finished).unwrap();
+        // Entries: [0..100 NonTried, 100..300 Finished (merged), 300..1000 NonTried]
+        let es = mf.entries();
+        assert_eq!(es.len(), 3);
+        assert_eq!(
+            (es[1].pos, es[1].size, es[1].status),
+            (100, 200, SectorStatus::Finished)
+        );
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn record_replaces_existing_status() {
+        let p = tmpfile("record_replaces_existing_status");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(200, 100, SectorStatus::Unreadable).unwrap();
+        mf.record(200, 100, SectorStatus::Finished).unwrap();
+        let es = mf.entries();
+        // The overwrite should result in all finished at 200..300, NonTried elsewhere — 3 entries.
+        assert_eq!(es.len(), 3);
+        assert_eq!(es[1].status, SectorStatus::Finished);
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn round_trip_load() {
+        let p = tmpfile("round_trip_load");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(100, 200, SectorStatus::Finished).unwrap();
+        mf.record(500, 100, SectorStatus::Unreadable).unwrap();
+        let loaded = Mapfile::load(&p).unwrap();
+        assert_eq!(loaded.entries(), mf.entries());
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn stats_sum_correctly() {
+        let p = tmpfile("stats_sum_correctly");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(0, 400, SectorStatus::Finished).unwrap();
+        mf.record(400, 100, SectorStatus::Unreadable).unwrap();
+        let s = mf.stats();
+        assert_eq!(s.bytes_good, 400);
+        assert_eq!(s.bytes_unreadable, 100);
+        assert_eq!(s.bytes_pending, 500);
+        assert_eq!(s.bytes_total, 1000);
+        let _ = std::fs::remove_file(&p);
+    }
+
+    #[test]
+    fn ranges_with_filters() {
+        let p = tmpfile("ranges_with_filters");
+        let _ = std::fs::remove_file(&p);
+        let mut mf = Mapfile::create(&p, 1000, "test").unwrap();
+        mf.record(100, 50, SectorStatus::Unreadable).unwrap();
+        mf.record(300, 50, SectorStatus::Unreadable).unwrap();
+        let bad = mf.ranges_with(&[SectorStatus::Unreadable]);
+        assert_eq!(bad, vec![(100, 50), (300, 50)]);
+        let _ = std::fs::remove_file(&p);
+    }
+}
@@ -11,6 +11,7 @@
 mod bluray;
 mod dvd;
 mod encrypt;
+pub mod mapfile;

 use crate::drive::Drive;
 use crate::error::{Error, Result};
@@ -1206,94 +1207,345 @@ impl Disc {

    /// Raw sector copy — write the entire disc image to a file.
    ///
-    /// This is NOT a stream operation. It copies sectors 0→capacity byte-for-byte,
-    /// producing a valid ISO/UDF image. The disc's filesystem structure is preserved.
+    /// NOT a stream operation. Copies sectors 0→capacity byte-for-byte producing
+    /// a valid ISO/UDF image. Records progress in a ddrescue-format mapfile at
+    /// `path + ".mapfile"` — flushed every block for crash-safe resume.
    ///
-    /// If `decrypt` is true and keys are available, sectors are decrypted on the fly.
-    /// If `resume` is true and the file already exists, resumes from the last safe position.
-    ///
-    /// `on_progress` is called periodically with (bytes_done, total_bytes).
+    /// # Options
+    /// - **default** (all false): behavior matches pre-v0.11.21 — uses full
+    ///   drive recovery (may take minutes per bad sector), aborts on error.
+    ///   Mapfile is produced as a side-effect.
+    /// - **skip_on_error**: zero-fill bad blocks in the ISO, mark them in the
+    ///   mapfile, and continue. Uses fast reads (no drive-level recovery loop).
+    /// - **skip_forward** (implies skip_on_error): on block failure, also skip
+    ///   forward by an exponentially-growing amount, marking the jumped region
+    ///   as `non-trimmed` for later trimming/scraping by `Disc::patch`.
+    /// - **resume**: if the mapfile exists, resume from its state — only
+    ///   `non-tried` ranges are read. Without `resume`, a fresh mapfile is
+    ///   written and the ISO recreated from scratch.
    pub fn copy(
        &self,
        reader: &mut dyn SectorReader,
        path: &std::path::Path,
-        decrypt: bool,
-        resume: bool,
-        batch_sectors: Option<u16>,
-        on_progress: Option<&dyn Fn(u64, u64)>,
-    ) -> Result<()> {
+        opts: &CopyOptions,
+    ) -> Result<CopyResult> {
        use std::io::{Seek, SeekFrom, Write};

        let total_bytes = self.capacity_sectors as u64 * 2048;
-        let keys = if decrypt {
+        let keys = if opts.decrypt {
            self.decrypt_keys()
        } else {
            crate::decrypt::DecryptKeys::None
        };

-        // Resume: check existing file
-        let (start_lba, file) = if resume {
-            match std::fs::metadata(path) {
-                Ok(meta) if meta.len() > 0 => {
-                    let safe_sectors = (meta.len() / 2048).saturating_sub(5) as u32;
-                    let mut f = std::fs::OpenOptions::new()
-                        .write(true)
-                        .open(path)
-                        .map_err(|e| Error::IoError { source: e })?;
-                    let resume_pos = safe_sectors as u64 * 2048;
-                    f.set_len(resume_pos)
-                        .map_err(|e| Error::IoError { source: e })?;
-                    f.seek(SeekFrom::End(0))
-                        .map_err(|e| Error::IoError { source: e })?;
-                    (safe_sectors, f)
-                }
-                _ => {
-                    let f =
-                        std::fs::File::create(path).map_err(|e| Error::IoError { source: e })?;
-                    (0u32, f)
-                }
-            }
-        } else {
-            let f = std::fs::File::create(path).map_err(|e| Error::IoError { source: e })?;
-            (0u32, f)
-        };
-
-        let mut writer = std::io::BufWriter::with_capacity(4 * 1024 * 1024, file);
-        let batch: u16 = batch_sectors.unwrap_or(DEFAULT_BATCH_SECTORS);
-        let mut lba = start_lba;
-        let mut bytes_done = start_lba as u64 * 2048;
-        let mut buf = vec![0u8; batch as usize * 2048];
-
-        while lba < self.capacity_sectors {
-            let remaining = self.capacity_sectors - lba;
-            let count = remaining.min(batch as u32) as u16;
-            let bytes = count as usize * 2048;
-
-            reader
-                .read_sectors(lba, count, &mut buf[..bytes], true)
-                .map_err(|e| Error::IoError {
-                    source: std::io::Error::other(e.to_string()),
-                })?;
-
-            // Decrypt if requested
-            if decrypt {
-                crate::decrypt::decrypt_sectors(&mut buf[..bytes], &keys, 0)?;
-            }
-
-            writer
-                .write_all(&buf[..bytes])
+        // Mapfile: load if resuming, else wipe + recreate.
+        let mapfile_path = mapfile_path_for(path);
+        if !opts.resume {
+            let _ = std::fs::remove_file(&mapfile_path);
+        }
+        let mut map =
+            mapfile::Mapfile::open_or_create(&mapfile_path, total_bytes, env!("CARGO_PKG_VERSION"))
                .map_err(|e| Error::IoError { source: e })?;

-            lba += count as u32;
-            bytes_done += bytes as u64;
+        // ISO file: if resuming and mapfile has Finished ranges, open existing;
+        // otherwise create fresh and pre-size to total_bytes (sparse holes for
+        // non-tried regions).
+        let file = if opts.resume
+            && std::fs::metadata(path)
+                .map(|m| m.len() > 0)
+                .unwrap_or(false)
+        {
+            std::fs::OpenOptions::new()
+                .write(true)
+                .open(path)
+                .map_err(|e| Error::IoError { source: e })?
+        } else {
+            let f = std::fs::File::create(path).map_err(|e| Error::IoError { source: e })?;
+            f.set_len(total_bytes)
+                .map_err(|e| Error::IoError { source: e })?;
+            f
+        };

-            if let Some(ref cb) = on_progress {
-                cb(bytes_done, total_bytes);
+        let mut file = file;
+        let batch: u16 = match opts.batch_sectors {
+            Some(b) => b,
+            None if opts.skip_forward => 32, // 64 KB = BD ECC block size
+            None => DEFAULT_BATCH_SECTORS,
+        };
+
+        // Skip-forward state.
+        let skip_init = 256 * 1024u64; // 256 KB
+        let skip_max = (total_bytes / 100).max(skip_init); // cap at 1% of disc
+        let mut skip_size = skip_init;
+
+        let mut buf = vec![0u8; batch as usize * 2048];
+        let mut bytes_done = 0u64;
+        let mut halt_requested = false;
+
+        // Iterate over not-yet-finished regions from the mapfile. We re-read the
+        // mapfile after each block because record() mutates the region list.
+        'outer: loop {
+            let regions_to_do = map.ranges_with(&[
+                mapfile::SectorStatus::NonTried,
+                mapfile::SectorStatus::NonTrimmed,
+                mapfile::SectorStatus::NonScraped,
+            ]);
+            if regions_to_do.is_empty() {
+                break;
+            }
+            // Only process the first NonTried range per outer pass; skip_forward
+            // may turn others into NonTrimmed which we DO NOT re-enter here —
+            // Disc::patch handles those.
+            let Some((region_pos, region_size)) = map.next_with(0, mapfile::SectorStatus::NonTried)
+            else {
+                break;
+            };
+            let region_end = region_pos + region_size;
+            let mut pos = region_pos;
+
+            while pos < region_end {
+                if let Some(ref h) = opts.halt {
+                    if h.load(std::sync::atomic::Ordering::Relaxed) {
+                        halt_requested = true;
+                        break 'outer;
+                    }
+                }
+                let block_bytes = (region_end - pos).min(batch as u64 * 2048);
+                let lba = (pos / 2048) as u32;
+                let count = (block_bytes / 2048) as u16;
+                let bytes = count as usize * 2048;
+
+                let recovery = !opts.skip_on_error; // fast reads when skipping
+                let read_ok = reader
+                    .read_sectors(lba, count, &mut buf[..bytes], recovery)
+                    .is_ok();
+
+                if read_ok {
+                    if opts.decrypt {
+                        crate::decrypt::decrypt_sectors(&mut buf[..bytes], &keys, 0)?;
+                    }
+                    file.seek(SeekFrom::Start(pos))
+                        .map_err(|e| Error::IoError { source: e })?;
+                    file.write_all(&buf[..bytes])
+                        .map_err(|e| Error::IoError { source: e })?;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::Finished)
+                        .map_err(|e| Error::IoError { source: e })?;
+                    bytes_done = bytes_done.saturating_add(block_bytes);
+                    skip_size = skip_init; // reset after success
+                    pos += block_bytes;
+                } else if opts.skip_on_error {
+                    // Zero-fill this block, mark non-trimmed for later patch trim.
+                    buf[..bytes].fill(0);
+                    file.seek(SeekFrom::Start(pos))
+                        .map_err(|e| Error::IoError { source: e })?;
+                    file.write_all(&buf[..bytes])
+                        .map_err(|e| Error::IoError { source: e })?;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::NonTrimmed)
+                        .map_err(|e| Error::IoError { source: e })?;
+                    pos += block_bytes;
+
+                    if opts.skip_forward && pos < region_end {
+                        // Skip ahead; mark skipped bytes as non-trimmed too.
+                        let jump = skip_size.min(region_end - pos);
+                        if jump > 0 {
+                            map.record(pos, jump, mapfile::SectorStatus::NonTrimmed)
+                                .map_err(|e| Error::IoError { source: e })?;
+                            pos += jump;
+                        }
+                        skip_size = (skip_size * 2).min(skip_max);
+                    }
+                } else {
+                    // Current behavior (pre-0.11.21): abort on first bad sector.
+                    return Err(Error::DiscRead { sector: lba as u64 });
+                }
+
+                if let Some(cb) = opts.on_progress {
+                    let stats = map.stats();
+                    cb(stats.bytes_good, total_bytes);
+                }
            }
        }

-        writer.flush().map_err(|e| Error::IoError { source: e })?;
-        Ok(())
+        file.sync_all().map_err(|e| Error::IoError { source: e })?;
+        let stats = map.stats();
+        Ok(CopyResult {
+            bytes_total: total_bytes,
+            bytes_good: stats.bytes_good,
+            bytes_unreadable: stats.bytes_unreadable,
+            bytes_pending: stats.bytes_pending,
+            complete: stats.bytes_pending == 0 && !halt_requested,
+            halted: halt_requested,
+        })
+    }
+}
+
+/// Options for `Disc::copy`. All fields default to the pre-v0.11.21 behavior
+/// (recovery reads, abort on bad sector).
+#[derive(Default)]
+pub struct CopyOptions<'a> {
+    pub decrypt: bool,
+    /// Resume from existing mapfile + ISO if present. Without this, any
+    /// existing mapfile is wiped and the ISO recreated.
+    pub resume: bool,
+    /// Override the default block size. Defaults to 32 sectors (64 KB) in
+    /// `skip_forward` mode, `DEFAULT_BATCH_SECTORS` otherwise.
+    pub batch_sectors: Option<u16>,
+    /// Zero-fill bad blocks in the ISO, mark them in the mapfile, continue.
+    /// Uses fast reads (no drive-level recovery loop).
+    pub skip_on_error: bool,
+    /// ddrescue-style exponential skip-forward on block failure. Implies
+    /// `skip_on_error`. The skipped region is marked `non-trimmed` for later
+    /// trimming/scraping by `Disc::patch`.
+    pub skip_forward: bool,
+    pub on_progress: Option<&'a dyn Fn(u64, u64)>,
+    pub halt: Option<std::sync::Arc<std::sync::atomic::AtomicBool>>,
+}
+
+/// Result of `Disc::copy`. `complete=true` means every byte reached a terminal
+/// state (Finished or Unreadable). `complete=false` means there's still pending
+/// work (halt, abort, or non-tried ranges) that `Disc::patch` or a resumed
+/// `Disc::copy` would continue.
+#[derive(Debug, Clone, Copy)]
+pub struct CopyResult {
+    pub bytes_total: u64,
+    pub bytes_good: u64,
+    pub bytes_unreadable: u64,
+    pub bytes_pending: u64,
+    pub complete: bool,
+    pub halted: bool,
+}
+
+/// Sidecar mapfile path for a given ISO path — `foo.iso` → `foo.iso.mapfile`.
+pub fn mapfile_path_for(iso_path: &std::path::Path) -> std::path::PathBuf {
+    let mut s = iso_path.as_os_str().to_os_string();
+    s.push(".mapfile");
+    std::path::PathBuf::from(s)
+}
+
+/// Options for `Disc::patch`. Idempotent — each call is one patch attempt.
+#[derive(Default)]
+pub struct PatchOptions<'a> {
+    pub decrypt: bool,
+    /// Sector-granularity block size for retries. Defaults to 1 sector (2 KB).
+    pub block_sectors: Option<u16>,
+    /// Use full drive-level recovery on each read (slow but thorough). Defaults
+    /// to true — patch is the pass where we *want* the drive to try hard.
+    pub full_recovery: bool,
+    pub on_progress: Option<&'a dyn Fn(u64, u64)>,
+    pub halt: Option<std::sync::Arc<std::sync::atomic::AtomicBool>>,
+}
+
+/// Result of `Disc::patch` — how many bad bytes were recovered.
+#[derive(Debug, Clone, Copy)]
+pub struct PatchResult {
+    pub bytes_total: u64,
+    pub bytes_good: u64,
+    pub bytes_unreadable: u64,
+    pub bytes_pending: u64,
+    pub bytes_recovered_this_pass: u64,
+    pub halted: bool,
+}
+
+impl Disc {
+    /// Patch an existing ISO using its sidecar mapfile. Re-reads every range
+    /// that's not yet `+` (Finished) and writes successful bytes into the ISO
+    /// at their exact offsets. Updates mapfile entries as it goes.
+    ///
+    /// Idempotent — call repeatedly to apply more retry attempts. Stops early
+    /// if a pass recovered zero bytes (no point continuing).
+    pub fn patch(
+        &self,
+        reader: &mut dyn SectorReader,
+        path: &std::path::Path,
+        opts: &PatchOptions,
+    ) -> Result<PatchResult> {
+        use std::io::{Seek, SeekFrom, Write};
+
+        let mapfile_path = mapfile_path_for(path);
+        let mut map =
+            mapfile::Mapfile::load(&mapfile_path).map_err(|e| Error::IoError { source: e })?;
+        let total_bytes = map.total_size();
+        let keys = if opts.decrypt {
+            self.decrypt_keys()
+        } else {
+            crate::decrypt::DecryptKeys::None
+        };
+
+        let mut file = std::fs::OpenOptions::new()
+            .write(true)
+            .open(path)
+            .map_err(|e| Error::IoError { source: e })?;
+
+        let block_sectors = opts.block_sectors.unwrap_or(1);
+        // Patch always reads with full drive recovery — this is the pass where
+        // we want the drive's ECC retry machinery. Consumers who want fast-fail
+        // use Disc::copy with skip_on_error instead.
+        let _ = opts.full_recovery;
+
+        let bytes_good_before = map.stats().bytes_good;
+        let mut halted = false;
+        let mut buf = vec![0u8; block_sectors as usize * 2048];
+
+        // Collect bad ranges up front. Iterating while mutating is fragile;
+        // each recorded change is persisted, so resume works even if we crash
+        // mid-loop.
+        let bad_ranges = map.ranges_with(&[
+            mapfile::SectorStatus::NonTried,
+            mapfile::SectorStatus::NonTrimmed,
+            mapfile::SectorStatus::NonScraped,
+            mapfile::SectorStatus::Unreadable,
+        ]);
+
+        'outer: for (range_pos, range_size) in bad_ranges {
+            let mut pos = range_pos;
+            let end = range_pos + range_size;
+            while pos < end {
+                if let Some(ref h) = opts.halt {
+                    if h.load(std::sync::atomic::Ordering::Relaxed) {
+                        halted = true;
+                        break 'outer;
+                    }
+                }
+                let block_bytes = (end - pos).min(block_sectors as u64 * 2048);
+                let lba = (pos / 2048) as u32;
+                let count = (block_bytes / 2048) as u16;
+                let bytes = count as usize * 2048;
+                let read_ok = reader
+                    .read_sectors(lba, count, &mut buf[..bytes], true)
+                    .is_ok();
+                if read_ok {
+                    if opts.decrypt {
+                        crate::decrypt::decrypt_sectors(&mut buf[..bytes], &keys, 0)?;
+                    }
+                    file.seek(SeekFrom::Start(pos))
+                        .map_err(|e| Error::IoError { source: e })?;
+                    file.write_all(&buf[..bytes])
+                        .map_err(|e| Error::IoError { source: e })?;
+                    map.record(pos, block_bytes, mapfile::SectorStatus::Finished)
+                        .map_err(|e| Error::IoError { source: e })?;
+                } else {
+                    map.record(pos, block_bytes, mapfile::SectorStatus::Unreadable)
+                        .map_err(|e| Error::IoError { source: e })?;
+                }
+                pos += block_bytes;
+
+                if let Some(cb) = opts.on_progress {
+                    let s = map.stats();
+                    cb(s.bytes_good, total_bytes);
+                }
+            }
+        }
+
+        file.sync_all().map_err(|e| Error::IoError { source: e })?;
+        let stats = map.stats();
+        Ok(PatchResult {
+            bytes_total: total_bytes,
+            bytes_good: stats.bytes_good,
+            bytes_unreadable: stats.bytes_unreadable,
+            bytes_pending: stats.bytes_pending,
+            bytes_recovered_this_pass: stats.bytes_good.saturating_sub(bytes_good_before),
+            halted,
+        })
    }
 }

@@ -18,14 +18,14 @@ mod windows;
 use crate::error::{Error, Result};
 use crate::event::{Event, EventKind};
 use crate::identity::DriveId;
-use crate::platform::mt1959::Mt1959;
 use crate::platform::PlatformDriver;
+use crate::platform::mt1959::Mt1959;
 use crate::profile::{self, DriveProfile};
 use crate::scsi::ScsiTransport;
 use crate::sector::SectorReader;
 use std::path::Path;
-use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};

 /// Physical state of the drive tray and disc.
 #[derive(Debug, Clone, Copy, PartialEq)]
@@ -128,6 +128,34 @@ impl Drive {
        self.halt.load(Ordering::Relaxed)
    }

+    /// Halt-aware sleep. Returns `Err(Halted)` if the flag fires before or
+    /// during the wait. The only sleep the drive's recovery path is allowed
+    /// to use — makes it impossible to accidentally block through a Stop.
+    fn checked_sleep(&self, total: std::time::Duration) -> Result<()> {
+        sleep_until_halted(&self.halt, total)
+    }
+
+    /// Halt-aware SCSI execute. Returns `Err(Halted)` if the flag is set
+    /// before the command dispatches or by the time it completes. The only
+    /// path to talk to the drive in the recovery hot loop; keeps Drive::read
+    /// free of explicit halt checks.
+    fn checked_exec(
+        &mut self,
+        cdb: &[u8],
+        dir: crate::scsi::DataDirection,
+        buf: &mut [u8],
+        timeout_ms: u32,
+    ) -> Result<crate::scsi::ScsiResult> {
+        if self.is_halted() {
+            return Err(Error::Halted);
+        }
+        let r = self.scsi.as_mut().execute(cdb, dir, buf, timeout_ms)?;
+        if self.is_halted() {
+            return Err(Error::Halted);
+        }
+        Ok(r)
+    }
+
    /// Close the drive cleanly. Unlocks tray, flushes SCSI state, closes fd.
    /// Also runs automatically on Drop as a safety net.
    pub fn close(self) {
@@ -497,8 +525,15 @@ impl Drive {
    /// Returns Err only after all attempts exhausted — user should clean
    /// the disc and resume.
    pub fn read(&mut self, lba: u32, count: u16, buf: &mut [u8], recovery: bool) -> Result<usize> {
+        // Non-recovery mode is the Disc::copy fast pass — intent is "fail
+        // fast, let skip_forward advance past bad regions." A 5s budget let
+        // the drive grind L-EC on structure-protected / marginal sectors for
+        // nearly the full interval per 64 KB block, pinning throughput at
+        // ~13 KB/s on difficult discs. 1500ms kills slow reads early so
+        // skip_forward can double its stride; recoverable sectors are picked
+        // up on Disc::patch where recovery=true and the timeout is 30s.
        let timeout_ms = if !recovery {
-            5_000
+            1_500
        } else if self.recovery_bytes_remaining > 0 {
            30_000
        } else {
@@ -517,26 +552,31 @@ impl Drive {
            0x00,
        ];

-        // Normal read
-        if let Ok(result) = self.scsi.as_mut().execute(
+        // Normal read. Fast path: drive returns data, we return it.
+        // checked_exec short-circuits to Err(Halted) if Stop was requested;
+        // read() never touches the halt flag directly.
+        match self.checked_exec(
            &cdb,
            crate::scsi::DataDirection::FromDevice,
            buf,
            timeout_ms,
        ) {
-            if self.recovery_bytes_remaining > 0 {
-                let bytes_read = count as u64 * 2048;
-                self.recovery_bytes_remaining =
-                    self.recovery_bytes_remaining.saturating_sub(bytes_read);
-                if self.recovery_bytes_remaining == 0 {
-                    self.emit(EventKind::SpeedChange { speed_kbs: 0xFFFF });
-                    self.set_speed(0xFFFF);
+            Ok(result) => {
+                if self.recovery_bytes_remaining > 0 {
+                    let bytes_read = count as u64 * 2048;
+                    self.recovery_bytes_remaining =
+                        self.recovery_bytes_remaining.saturating_sub(bytes_read);
+                    if self.recovery_bytes_remaining == 0 {
+                        self.emit(EventKind::SpeedChange { speed_kbs: 0xFFFF });
+                        self.set_speed(0xFFFF);
+                    }
                }
+                return Ok(result.bytes_transferred);
            }
-            return Ok(result.bytes_transferred);
+            Err(Error::Halted) => return Err(Error::Halted),
+            Err(_) => { /* fall through to recovery */ }
        }

-        // Read failed
        if !recovery {
            return Err(Error::DiscRead { sector: lba as u64 });
        }
@@ -549,58 +589,36 @@ impl Drive {
        self.emit(EventKind::SpeedChange { speed_kbs: 0 });
        self.set_speed(0);

-        // Phase 1: gentle — sleep 30s, retry. 5 times.
+        // Phase 1: gentle — sleep 30 s, retry. 5 times.
        for attempt in 1..=5u32 {
-            if self.is_halted() {
-                return Err(Error::Halted);
-            }
            self.emit(EventKind::Retry { attempt });
-            std::thread::sleep(std::time::Duration::from_secs(30));
-
-            if let Ok(result) = self.scsi.as_mut().execute(
-                &cdb,
-                crate::scsi::DataDirection::FromDevice,
-                buf,
-                30_000,
-            ) {
+            self.checked_sleep(std::time::Duration::from_secs(30))?;
+            if let Ok(result) =
+                self.checked_exec(&cdb, crate::scsi::DataDirection::FromDevice, buf, 30_000)
+            {
                self.emit(EventKind::SectorRecovered { sector: lba as u64 });
                self.recovery_bytes_remaining = RECOVERY_WINDOW;
                return Ok(result.bytes_transferred);
            }
        }

-        if self.is_halted() {
-            return Err(Error::Halted);
-        }
-
        // Phase 2: fresh start — close, reset, open, init.
        let device = std::path::PathBuf::from(&self.device_path);
-        std::thread::sleep(std::time::Duration::from_secs(5));
+        self.checked_sleep(std::time::Duration::from_secs(5))?;
        let _ = crate::scsi::reset(&device);
-        std::thread::sleep(std::time::Duration::from_secs(5));
+        self.checked_sleep(std::time::Duration::from_secs(5))?;
        self.scsi = crate::scsi::open(&device)?;
        let _ = self.init();
        let _ = self.wait_ready();
        self.set_speed(0);

-        if self.is_halted() {
-            return Err(Error::Halted);
-        }
-
-        // Phase 3: gentle again on fresh connection — sleep 30s, retry. 5 times.
+        // Phase 3: gentle again on fresh connection — sleep 30 s, retry. 5 times.
        for attempt in 6..=10u32 {
-            if self.is_halted() {
-                return Err(Error::Halted);
-            }
            self.emit(EventKind::Retry { attempt });
-            std::thread::sleep(std::time::Duration::from_secs(30));
-
-            if let Ok(result) = self.scsi.as_mut().execute(
-                &cdb,
-                crate::scsi::DataDirection::FromDevice,
-                buf,
-                30_000,
-            ) {
+            self.checked_sleep(std::time::Duration::from_secs(30))?;
+            if let Ok(result) =
+                self.checked_exec(&cdb, crate::scsi::DataDirection::FromDevice, buf, 30_000)
+            {
                self.emit(EventKind::SectorRecovered { sector: lba as u64 });
                self.recovery_bytes_remaining = RECOVERY_WINDOW;
                return Ok(result.bytes_transferred);
@@ -721,6 +739,27 @@ impl SectorReader for Drive {
    }
 }

+/// Halt-aware sleep primitive. Returns `Err(Halted)` if the flag is set
+/// before or during the wait. Extracted as a free function so it can be
+/// unit-tested without constructing a full `Drive`.
+///
+/// Wakes within ~100 ms of a halt, regardless of the requested duration.
+fn sleep_until_halted(halt: &AtomicBool, total: std::time::Duration) -> Result<()> {
+    const SLICE: std::time::Duration = std::time::Duration::from_millis(100);
+    let deadline = std::time::Instant::now() + total;
+    loop {
+        if halt.load(Ordering::Relaxed) {
+            return Err(Error::Halted);
+        }
+        let now = std::time::Instant::now();
+        if now >= deadline {
+            return Ok(());
+        }
+        let remaining = deadline - now;
+        std::thread::sleep(remaining.min(SLICE));
+    }
+}
+
 /// Find all optical drives connected to this system.
 /// Returns opened Drive objects ready for use.
 pub fn find_drives() -> Vec<Drive> {
@@ -783,3 +822,53 @@ fn create_driver(
        }),
    }
 }
+
+#[cfg(test)]
+mod halt_tests {
+    use super::*;
+    use std::time::{Duration, Instant};
+
+    #[test]
+    fn sleep_until_halted_completes_when_not_halted() {
+        let flag = AtomicBool::new(false);
+        let t0 = Instant::now();
+        let r = sleep_until_halted(&flag, Duration::from_millis(150));
+        assert!(r.is_ok());
+        assert!(t0.elapsed() >= Duration::from_millis(140));
+    }
+
+    #[test]
+    fn sleep_until_halted_returns_immediately_if_preflagged() {
+        let flag = AtomicBool::new(true);
+        let t0 = Instant::now();
+        let r = sleep_until_halted(&flag, Duration::from_secs(10));
+        assert!(matches!(r, Err(Error::Halted)));
+        // Must wake within one slice (100 ms) — the whole point of the
+        // primitive is that a 30 s sleep doesn't block Stop.
+        assert!(t0.elapsed() < Duration::from_millis(200));
+    }
+
+    #[test]
+    fn sleep_until_halted_wakes_mid_sleep() {
+        let flag = Arc::new(AtomicBool::new(false));
+        let f2 = flag.clone();
+        let t0 = Instant::now();
+        std::thread::spawn(move || {
+            std::thread::sleep(Duration::from_millis(150));
+            f2.store(true, Ordering::Relaxed);
+        });
+        let r = sleep_until_halted(&flag, Duration::from_secs(10));
+        assert!(matches!(r, Err(Error::Halted)));
+        let waited = t0.elapsed();
+        // Flag flipped at ~150 ms; we wake within one 100 ms slice → <300 ms.
+        assert!(waited < Duration::from_millis(350), "waited {waited:?}");
+        assert!(waited >= Duration::from_millis(140), "waited {waited:?}");
+    }
+
+    #[test]
+    fn sleep_until_halted_zero_duration_is_noop_when_not_halted() {
+        let flag = AtomicBool::new(false);
+        let r = sleep_until_halted(&flag, Duration::ZERO);
+        assert!(r.is_ok());
+    }
+}
@@ -80,14 +80,21 @@ pub enum EventKind {
        sector_count: u64,
    },

-    /// Binary search isolated and recovered a marginal sector.
+    /// Sector recovered after a retry (Drive::read multi-phase recovery).
    SectorRecovered { sector: u64 },

    /// Sector unreadable, zero-filled (skip mode).
    SectorSkipped { sector: u64 },

-    /// Binary search activated — batch failed, isolating bad sector.
-    BinarySearch { sector: u64, batch_size: u16 },
+    /// Adaptive batch sizer changed the read size.
+    ///
+    /// Fires on shrink (read failed at larger size) and on probe-up
+    /// (enough clean reads to try larger again). Consumers use this to
+    /// display a "recovering" state distinct from "ripping normally".
+    BatchSizeChanged {
+        new_size: u16,
+        reason: BatchSizeReason,
+    },

    /// Operation complete.
    Complete {
@@ -98,5 +105,14 @@ pub enum EventKind {
    },
 }

+/// Why the adaptive batch sizer changed size.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BatchSizeReason {
+    /// Read failed; sizer halved the batch.
+    Shrunk,
+    /// Clean-read streak threshold hit; sizer doubled toward preferred.
+    Probed,
+}
+
 /// A no-op event handler. Ignores all events.
 pub fn ignore(_event: Event) {}
@@ -734,12 +734,12 @@ mod tests {
        let mut pgc = vec![0u8; 0xEA];
        pgc[0x02] = 1; // 1 program
        pgc[0x03] = 2; // 2 cells
-                       // 1h 59m 30s at 29.97fps, 0 frames
+        // 1h 59m 30s at 29.97fps, 0 frames
        pgc[0x04] = 0x01; // hours BCD
        pgc[0x05] = 0x59; // minutes BCD
        pgc[0x06] = 0x30; // seconds BCD
        pgc[0x07] = 0b11_000000; // 29.97fps, 0 frames
-                                 // Cell playback info offset at PGC+0xE8
+        // Cell playback info offset at PGC+0xE8
        let cell_offset: u16 = 0xEA; // right after minimum header
        pgc[0xE8] = (cell_offset >> 8) as u8;
        pgc[0xE9] = cell_offset as u8;
@@ -755,7 +755,7 @@ mod tests {
        pgc[co + 21] = 0;
        pgc[co + 22] = 0;
        pgc[co + 23] = 200; // last sector
-                            // Cell 1: sectors 300-400
+        // Cell 1: sectors 300-400
        let co = 0xEA + 24;
        pgc[co + 8] = 0;
        pgc[co + 9] = 0;
@@ -4,7 +4,7 @@
 //! When both exist, language_streams.txt provides structured types while
 //! menu_base.prop provides stream number → button name mapping.

-use super::{vocab, LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType};
+use super::{LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType, vocab};
 use crate::sector::SectorReader;
 use crate::udf::UdfFs;
 use std::collections::HashMap;
@@ -5,7 +5,7 @@
 //!
 //! Token format: `{lang}_{codec?}_{purpose?}_{region?}_`

-use super::{vocab, LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType};
+use super::{LabelPurpose, LabelQualifier, StreamLabel, StreamLabelType, vocab};
 use crate::sector::SectorReader;
 use crate::udf::UdfFs;

@@ -95,15 +95,15 @@ pub(crate) mod udf;
 pub mod verify;

 pub use drive::capture::{
-    capture_drive_data, mask_bytes, mask_string, CapturedFeature, DriveCapture,
+    CapturedFeature, DriveCapture, capture_drive_data, mask_bytes, mask_string,
 };
-pub use drive::{find_drive, find_drives, Drive, DriveStatus};
+pub use drive::{Drive, DriveStatus, find_drive, find_drives};
 pub use error::{Error, Result};
 pub use event::{Event, EventKind};
 pub use identity::DriveId;
 pub use profile::DriveProfile;
 // Platform trait is pub(crate) -- callers use Drive, not Platform directly
-pub use decrypt::{decrypt_sectors, DecryptKeys};
+pub use decrypt::{DecryptKeys, decrypt_sectors};
 pub use disc::{
    AacsState, AudioChannels, AudioStream, Clip, Codec, ColorSpace, ContentFormat, Disc,
    DiscFormat, DiscId, DiscTitle, Extent, FrameRate, HdrFormat, KeySource, Resolution, SampleRate,
@@ -115,8 +115,8 @@ pub use mux::MkvStream;
 pub use mux::NetworkStream;
 pub use mux::NullStream;
 pub use mux::StdioStream;
-pub use mux::{input, output, parse_url, InputOptions, StreamUrl};
+pub use mux::{InputOptions, StreamUrl, input, output, parse_url};
 pub use scsi::ScsiTransport;
-pub use sector::SectorReader;
+pub use sector::{FileSectorReader, SectorReader};
 pub use speed::DriveSpeed;
-pub use udf::{read_filesystem, UdfFs};
+pub use udf::{UdfFs, read_filesystem};
@@ -4,7 +4,7 @@
 //! Buffers across PES boundaries so frames that span two PES packets
 //! are emitted complete, not truncated.

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 pub struct Ac3Parser {
    /// Leftover bytes from previous PES (incomplete frame at end).
@@ -5,7 +5,7 @@
 //! Buffers across PES boundaries so frames spanning two PES packets
 //! are emitted complete.

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 const DTS_CORE_SYNC: [u8; 4] = [0x7F, 0xFE, 0x80, 0x01];
 const DTS_HD_EXT_SYNC: [u8; 4] = [0x64, 0x58, 0x20, 0x25];
@@ -7,7 +7,7 @@
 //! For MKV: codec ID "S_VOBSUB".
 //! All frames are keyframes (each is a complete bitmap).

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 pub struct DvdSubParser {
    /// Pre-formatted VobSub .idx palette header for codec_private.
@@ -4,7 +4,7 @@
 //! Detects keyframes (IDR slices).
 //! Each PES packet = one access unit = one frame.

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 /// H.264 NAL unit types we care about.
 const NAL_SLICE_IDR: u8 = 5;
@@ -263,7 +263,7 @@ mod tests {
        data.extend_from_slice(&[0x00, 0x00, 0x01]);
        data.push(0x67); // SPS
        data.extend_from_slice(&[0x42, 0x00, 0x1E, 0xAB, 0xCD]); // profile=0x42, compat=0x00, level=0x1E
-                                                                 // PPS: 00 00 01 [68 <payload>]
+        // PPS: 00 00 01 [68 <payload>]
        data.extend_from_slice(&[0x00, 0x00, 0x01]);
        data.push(0x68); // PPS
        data.extend_from_slice(&[0xCE, 0x01]);
@@ -5,7 +5,7 @@
 //! Each PES packet = one access unit = one frame.

 use super::h264::{find_start_code, skip_start_code};
-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 // HEVC NAL unit types
 const NAL_VPS: u8 = 32;
@@ -122,7 +122,7 @@ impl CodecParser for HevcParser {

        // Minimal HEVCDecoderConfigurationRecord header
        record.push(1); // configurationVersion
-                        // General profile space, tier flag, profile IDC from SPS
+        // General profile space, tier flag, profile IDC from SPS
        if sps.len() > 3 {
            record.push(sps[1]); // general_profile_space + general_tier_flag + general_profile_idc
        } else {
@@ -154,7 +154,7 @@ impl CodecParser for HevcParser {
        record.push(0xFC);
        // chromaFormat (6 + 2 bits)
        record.push(0xFC | 1); // 4:2:0
-                               // bitDepthLumaMinus8 (5 + 3 bits)
+        // bitDepthLumaMinus8 (5 + 3 bits)
        record.push(0xF8);
        // bitDepthChromaMinus8 (5 + 3 bits)
        record.push(0xF8);
@@ -162,7 +162,7 @@ impl CodecParser for HevcParser {
        record.extend_from_slice(&[0, 0]);
        // constantFrameRate + numTemporalLayers + temporalIdNested + lengthSizeMinusOne
        record.push(0x03); // lengthSizeMinusOne = 3 (4 bytes)
-                           // numOfArrays
+        // numOfArrays
        record.push(3); // VPS, SPS, PPS

        // VPS array
@@ -13,7 +13,7 @@
 //! For MKV: codec ID "A_PCM/INT/BIG" (BD) or "A_PCM/INT/LIT" (DVD).
 //! All frames are keyframes (uncompressed audio).

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 /// BD LPCM header size in bytes.
 const BD_LPCM_HEADER_SIZE: usize = 4;
@@ -9,7 +9,7 @@
 //! - Sequence extension: 00 00 01 B5
 //! - Picture header: 00 00 01 00

-use super::{pts_to_ns, CodecParser, Frame};
+use super::{CodecParser, Frame, pts_to_ns};
 use crate::mux::ts::PesPacket;

 /// Sequence header start code suffix.
@@ -415,7 +415,7 @@ mod tests {
        // Sequence extension: 00 00 01 B5 [ext data]
        data.extend_from_slice(&[0x00, 0x00, 0x01, SEQ_EXT_CODE]);
        data.extend_from_slice(&[0x14, 0x8A, 0x00, 0x01, 0x00, 0x00]); // ext payload
-                                                                       // Picture header follows.
+        // Picture header follows.
        data.extend_from_slice(&make_picture_header(PICTURE_TYPE_I));
        data.extend_from_slice(&[0xFF; 4]);

@@ -4,7 +4,7 @@
 //! Each PES packet contains one or more segments.
 //! All segments are keyframes (no inter-segment dependencies).

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 pub struct PgsParser;

@@ -11,7 +11,7 @@
 //! AC-3 frames (interleaved, same PID): start with sync word 0x0B77.
 //! We skip AC-3 frames and only emit TrueHD access units.

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 /// Duration of one TrueHD access unit in nanoseconds (1/1200 second).
 const AU_DURATION_NS: i64 = 833_333;
@@ -5,7 +5,7 @@
 //! Frame start = Frame header start code (0x0D).
 //! I-frames (keyframes) are identified from the frame header.

-use super::{pts_to_ns, CodecParser, Frame, PesPacket};
+use super::{CodecParser, Frame, PesPacket, pts_to_ns};

 const SC_SEQUENCE_HEADER: u8 = 0x0F;
 const SC_ENTRY_POINT: u8 = 0x0E;
@@ -6,9 +6,92 @@
 //! Read-only. For disc→ISO (raw sector copy), use `Disc::copy()`.

 use crate::disc::{Disc, DiscTitle, Extent};
-use crate::event::{Event, EventKind};
+use crate::event::{BatchSizeReason, Event, EventKind};
 use crate::sector::SectorReader;
 use std::io;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+/// Ramp back up to the preferred batch size after this many sectors
+/// of clean reading at the current (reduced) size. 100 MiB = 51,200 sectors.
+///
+/// Chosen so that an isolated transient failure doesn't lock the rip at
+/// size 1: once past the bad zone, we probe up after ~100 ms of good reads.
+/// And so that noisy zones with occasional successes can't trigger a
+/// premature probe — we need a sustained clean run.
+const PROBE_THRESHOLD_SECTORS: u32 = 100 * 1024 * 1024 / 2048;
+
+/// Halve a batch size, keeping 3-sector alignment when >= 6
+/// (3-sector alignment = one AACS unit). At sizes < 6 we descend
+/// through 3 → 1 without intermediate unaligned sizes.
+fn halve_batch_size(size: u16) -> u16 {
+    let h = (size / 2).max(1);
+    if h >= 6 { h - (h % 3) } else { h }
+}
+
+/// Double a batch size toward a preferred max, keeping 3-sector alignment
+/// when the result is >= 6.
+fn double_batch_size(size: u16, preferred: u16) -> u16 {
+    let d = size.saturating_mul(2).min(preferred);
+    if d >= 6 { d - (d % 3) } else { d }
+}
+
+/// Adaptive batch sizer. Shrinks on read failure, grows after a sustained
+/// clean streak. Amortizes the cost of entering a bad zone — descent happens
+/// once, not once per bad sector.
+#[derive(Debug)]
+struct AdaptiveBatch {
+    preferred: u16,
+    current: u16,
+    streak_sectors: u32,
+}
+
+impl AdaptiveBatch {
+    fn new(preferred: u16) -> Self {
+        Self {
+            preferred,
+            current: preferred,
+            streak_sectors: 0,
+        }
+    }
+
+    fn current(&self) -> u16 {
+        self.current
+    }
+
+    /// Record a successful read of `sectors`. Returns an event if the
+    /// sizer probed up to a larger batch size.
+    fn on_success(&mut self, sectors: u16) -> Option<EventKind> {
+        self.streak_sectors = self.streak_sectors.saturating_add(sectors as u32);
+        if self.current < self.preferred && self.streak_sectors >= PROBE_THRESHOLD_SECTORS {
+            let new_size = double_batch_size(self.current, self.preferred);
+            if new_size != self.current {
+                self.current = new_size;
+                self.streak_sectors = 0;
+                return Some(EventKind::BatchSizeChanged {
+                    new_size,
+                    reason: BatchSizeReason::Probed,
+                });
+            }
+        }
+        None
+    }
+
+    /// Record a read failure. Returns an event if the sizer shrank.
+    /// Does nothing at size 1 (caller handles skip/error).
+    fn on_failure(&mut self) -> Option<EventKind> {
+        self.streak_sectors = 0;
+        if self.current <= 1 {
+            return None;
+        }
+        let new_size = halve_batch_size(self.current);
+        self.current = new_size;
+        Some(EventKind::BatchSizeChanged {
+            new_size,
+            reason: BatchSizeReason::Shrunk,
+        })
+    }
+}

 /// Disc stream. Reads sectors from any source → PES frames.
 ///
@@ -31,10 +114,16 @@ pub struct DiscStream {
    read_buf: Vec<u8>,
    buf_valid: usize,

-    // Batch size for reads
-    batch_sectors: u16,
+    // Adaptive batch sizer — preferred comes from the caller
+    // (detect_max_batch_sectors), shrinks/grows based on read outcomes.
+    adaptive: AdaptiveBatch,
    pub errors: u64,
    pub skip_errors: bool,
+    /// When set and the flag is raised, fill_extents returns Err(Halted) at the
+    /// next retry boundary. Unlike skip_errors, this propagates the error up so
+    /// the rip terminates cleanly. Share the Arc with Drive::halt_flag() to get
+    /// unified Stop behavior across drive reads and sector processing.
+    halt: Option<Arc<AtomicBool>>,
    event_fn: Option<Box<dyn Fn(Event) + Send>>,
    eof: bool,

@@ -99,9 +188,10 @@ impl DiscStream {
            current_offset: 0,
            read_buf: Vec::with_capacity(batch_sectors as usize * 2048),
            buf_valid: 0,
-            batch_sectors,
+            adaptive: AdaptiveBatch::new(batch_sectors),
            errors: 0,
            skip_errors: false,
+            halt: None,
            event_fn: None,
            eof: false,
            ts_demuxer,
@@ -117,6 +207,22 @@ impl DiscStream {
        self.event_fn = Some(Box::new(f));
    }

+    /// Share a halt flag — typically from `Drive::halt_flag()`. When raised,
+    /// the next read-retry boundary inside fill_extents returns Err(Halted)
+    /// instead of continuing. Required for Stop to work during dense bad-sector
+    /// regions (where read() loops internally waiting for enough clean data to
+    /// emit a frame and would otherwise never check an external stop signal).
+    pub fn set_halt(&mut self, flag: Arc<AtomicBool>) {
+        self.halt = Some(flag);
+    }
+
+    fn is_halted(&self) -> bool {
+        self.halt
+            .as_ref()
+            .map(|h| h.load(Ordering::Relaxed))
+            .unwrap_or(false)
+    }
+
    fn emit(&self, kind: EventKind) {
        if let Some(ref f) = self.event_fn {
            f(Event { kind });
@@ -133,74 +239,6 @@ impl DiscStream {
        self.disc.as_ref()
    }

-    /// Binary search to isolate failing sectors within a batch.
-    /// Good sub-batches read fast. Bad sectors get 3 retries × 5s — max 15s per sector.
-    /// No full Drive::read() recovery — that only runs on the initial batch attempt.
-    fn read_with_binary_search(&mut self, lba: u32, count: u16) -> io::Result<()> {
-        if count <= 1 {
-            // Single sector — light recovery: 3 attempts, 5s sleep between
-            let offset = self.buf_valid;
-            for attempt in 0..3u32 {
-                if attempt > 0 {
-                    std::thread::sleep(std::time::Duration::from_secs(5));
-                }
-                if self
-                    .reader
-                    .read_sectors(lba, 1, &mut self.read_buf[offset..offset + 2048], false)
-                    .is_ok()
-                {
-                    self.emit(EventKind::SectorRecovered { sector: lba as u64 });
-                    self.buf_valid += 2048;
-                    return Ok(());
-                }
-            }
-            // 3 attempts failed
-            if self.skip_errors {
-                self.emit(EventKind::SectorSkipped { sector: lba as u64 });
-                self.read_buf[offset..offset + 2048].fill(0);
-                self.buf_valid += 2048;
-                self.errors += 1;
-                return Ok(());
-            } else {
-                return Err(crate::error::Error::DiscRead { sector: lba as u64 }.into());
-            }
-        }
-
-        // Try this sub-batch as a whole (fast read, no recovery)
-        let bytes = count as usize * 2048;
-        let offset = self.buf_valid;
-        if self
-            .reader
-            .read_sectors(
-                lba,
-                count,
-                &mut self.read_buf[offset..offset + bytes],
-                false,
-            )
-            .is_ok()
-        {
-            self.buf_valid += bytes;
-            return Ok(());
-        }
-
-        // Sub-batch failed — split in half and recurse
-        self.emit(EventKind::BinarySearch {
-            sector: lba as u64,
-            batch_size: count,
-        });
-
-        let half = count / 2;
-        let half = half - (half % 3).min(half);
-        let half = half.max(1);
-        let remainder = count - half;
-
-        self.read_with_binary_search(lba, half)?;
-        if remainder > 0 {
-            self.read_with_binary_search(lba + half as u32, remainder)?;
-        }
-        Ok(())
-    }
-
    fn fill_extents(&mut self) -> io::Result<bool> {
        if self.current_extent >= self.extents.len() {
            return Ok(false);
@@ -214,32 +252,65 @@ impl DiscStream {
            self.current_offset = 0;
            return self.fill_extents();
        }
-        let mut sectors = remaining.min(self.batch_sectors as u32) as u16;
-        // Align to 3-sector AACS units when possible, but never drop
-        // trailing sectors at extent boundaries. decrypt_sectors() safely
-        // skips partial units (chunks shorter than ALIGNED_UNIT_LEN).
-        if sectors >= 3 {
-            sectors -= sectors % 3;
-        }

        let lba = ext_start + self.current_offset;
-        let bytes = sectors as usize * 2048;
-        self.read_buf.resize(bytes, 0);

-        if self
-            .reader
-            .read_sectors(lba, sectors, &mut self.read_buf[..bytes], false)
-            .is_ok()
-        {
-            // Fast path: batch succeeded
-            self.buf_valid = bytes;
-        } else {
-            // Batch failed fast — binary search to isolate bad sectors.
-            // Light recovery only (3x5s per sector, no full Drive::read).
-            self.buf_valid = 0;
-            self.read_with_binary_search(lba, sectors)?;
+        // Adaptive sizer: start at current (preferred until a failure), shrink
+        // on failure, advance on success. One 5s read attempt per try — no
+        // retry loops, no sleeps. On size-1 failure, skip or error.
+        //
+        // Halt is checked at the top of every iteration — in a dense bad zone
+        // this loop can spend minutes shrinking and skipping sectors; without
+        // the check, Stop wouldn't take effect until the outer PES read() loop
+        // finally emits a frame, which may never happen.
+        loop {
+            if self.is_halted() {
+                return Err(crate::error::Error::Halted.into());
+            }
+            let mut sectors = remaining.min(self.adaptive.current() as u32) as u16;
+            // Align to 3-sector AACS units when possible. Partial units at
+            // extent boundaries are safely handled by decrypt_sectors().
+            if sectors >= 3 {
+                sectors -= sectors % 3;
+            }
+            let bytes = sectors as usize * 2048;
+            self.read_buf.resize(bytes, 0);
+
+            let ok = self
+                .reader
+                .read_sectors(lba, sectors, &mut self.read_buf[..bytes], false)
+                .is_ok();
+
+            if ok {
+                if let Some(ev) = self.adaptive.on_success(sectors) {
+                    self.emit(ev);
+                }
+                self.buf_valid = bytes;
+                self.current_offset += sectors as u32;
+                break;
+            }
+
+            if sectors == 1 {
+                // Bottomed out. Skip this sector or bail.
+                if self.skip_errors {
+                    self.read_buf.resize(2048, 0);
+                    self.read_buf[..2048].fill(0);
+                    self.buf_valid = 2048;
+                    self.errors += 1;
+                    self.emit(EventKind::SectorSkipped { sector: lba as u64 });
+                    self.current_offset += 1;
+                    break;
+                } else {
+                    return Err(crate::error::Error::DiscRead { sector: lba as u64 }.into());
+                }
+            }
+
+            // Shrink and retry at the same LBA with a smaller batch.
+            if let Some(ev) = self.adaptive.on_failure() {
+                self.emit(ev);
+            }
        }
-        self.current_offset += sectors as u32;
+
        if self.current_offset >= ext_sectors {
            self.current_extent += 1;
            self.current_offset = 0;
@@ -441,7 +441,7 @@ mod tests {
    fn test_write_uint() {
        let mut buf = Vec::new();
        write_uint(&mut buf, 0x4286, 1).unwrap(); // EBML_VERSION = 1
-                                                  // ID: 42 86, Size: 81 (1 byte), Data: 01
+        // ID: 42 86, Size: 81 (1 byte), Data: 01
        assert_eq!(buf, [0x42, 0x86, 0x81, 0x01]);
    }

@@ -211,7 +211,7 @@ impl M2tsMeta {
            .iter()
            .map(|s| {
                if let MetaStream::Video {
-                    codec_private: Some(ref b64),
+                    codec_private: Some(b64),
                    ..
                } = s
                {
@@ -699,7 +699,7 @@ mod tests {
            // Track VINT: 1 byte (track 1 = 0x81)
            let track_vint_pos = after_id + size_len;
            let track_vint_len = 1; // track 1 encoded as 0x81
-                                    // 2-byte relative timestamp
+            // 2-byte relative timestamp
            let ts_pos = track_vint_pos + track_vint_len;
            // flags byte
            let flags_pos = ts_pos + 2;
@@ -4,7 +4,7 @@
 //! Write: PES frames in → MKV mux → Matroska container.

 use super::mkv::{MkvMuxer, MkvTrack};
-use super::{ebml, WriteSeek};
+use super::{WriteSeek, ebml};

 type MkvHeaderResult = io::Result<(crate::disc::DiscTitle, Vec<(u16, Vec<u8>)>)>;

@@ -150,9 +150,9 @@ impl crate::pes::Stream for MkvStream {

    fn write(&mut self, frame: &crate::pes::PesFrame) -> io::Result<()> {
        match &mut self.mode {
-            Mode::Write {
-                muxer: Some(ref mut m),
-            } => m.write_frame(frame.track, frame.pts, frame.keyframe, &frame.data),
+            Mode::Write { muxer: Some(m) } => {
+                m.write_frame(frame.track, frame.pts, frame.keyframe, &frame.data)
+            }
            Mode::Write { muxer: None } => Ok(()),
            Mode::Read(_) => Err(crate::error::Error::StreamReadOnly.into()),
        }
@@ -38,7 +38,7 @@ pub use m2ts::M2tsStream;
 pub use mkvstream::MkvStream;
 pub use network::NetworkStream;
 pub use null::NullStream;
-pub use resolve::{input, output, parse_url, InputOptions, StreamUrl};
+pub use resolve::{InputOptions, StreamUrl, input, output, parse_url};
 pub use stdio::StdioStream;

 use std::io::{Seek, Write};
@@ -81,7 +81,7 @@ impl crate::pes::Stream for NetworkStream {
        match &mut self.mode {
            Mode::Write {
                writer,
-                ref mut header_written,
+                header_written,
                ..
            } => {
                if !*header_written {
@@ -70,7 +70,7 @@ impl crate::pes::Stream for StdioStream {
    }
    fn write(&mut self, frame: &crate::pes::PesFrame) -> io::Result<()> {
        match &mut self.writer {
-            Some(ref mut w) => {
+            Some(w) => {
                if !self.header_written {
                    if !self.disc_title.streams.is_empty() {
                        let m = meta::M2tsMeta::from_title(&self.disc_title);
@@ -227,11 +227,7 @@ fn hvcc_to_annex_b(hvcc: &[u8]) -> Option<Vec<u8>> {
        }
    }

-    if out.is_empty() {
-        None
-    } else {
-        Some(out)
-    }
+    if out.is_empty() { None } else { Some(out) }
 }

 /// Convert length-prefixed NALUs (4-byte BE length + NAL) to Annex B
@@ -63,7 +63,8 @@ struct SCSITaskSGElement {

 // ── External IOKit / CoreFoundation functions ───────────────────────────────

-extern "C" {
+// Rust 2024: FFI blocks declaring extern fns must be `unsafe extern`.
+unsafe extern "C" {
    fn IOMasterPort(bootstrap: u32, master: *mut MachPort) -> IOReturn;
    fn IOBSDNameMatching(
        master: MachPort,
@@ -97,10 +98,18 @@ extern "C" {
 // IOSCSIArchitectureModelFamily/UserClientLib/SCSITaskLib.h

 /// Read a function pointer from a COM vtable at the given index.
+///
+/// # Safety
+/// `iface` must be a valid COM interface pointer (*mut *mut c_void), and
+/// `index` must be a valid vtable slot for the target type `T`.
 unsafe fn vtable_fn<T>(iface: ComRef, index: usize) -> T {
-    let vtable = *iface as *const *const std::ffi::c_void;
-    let fn_ptr = *vtable.add(index);
-    std::mem::transmute_copy(&fn_ptr)
+    // Rust 2024: `unsafe fn` bodies are no longer implicitly unsafe.
+    // Each unsafe op needs its own `unsafe { }` block.
+    unsafe {
+        let vtable = *iface as *const *const std::ffi::c_void;
+        let fn_ptr = *vtable.add(index);
+        std::mem::transmute_copy(&fn_ptr)
+    }
 }

 /// Call Release (vtable index 3) on any COM interface.
@@ -455,8 +464,9 @@ fn walk_to_authoring_device(start: IOObject) -> Option<IOObject> {
    // Walk up to 10 levels (more than enough)
    for _ in 0..10 {
        let mut parent: IOObject = 0;
-        let kr =
-            unsafe { IORegistryEntryGetParentEntry(current, b"IOService\0".as_ptr(), &mut parent) };
+        let kr = unsafe {
+            IORegistryEntryGetParentEntry(current, c"IOService".as_ptr() as *const u8, &mut parent)
+        };

        if current != start {
            unsafe { IOObjectRelease(current) };
@@ -56,7 +56,7 @@ struct SptwbDirect {

 // ── Windows FFI ────────────────────────────────────────────────────────────

-extern "system" {
+unsafe extern "system" {
    fn CreateFileW(
        lpFileName: *const u16,
        dwDesiredAccess: u32,
@@ -101,7 +101,7 @@ impl UdfFs {
            None => {
                return Err(Error::UdfNotFound {
                    path: path.to_string(),
-                })
+                });
            }
        };
        let entry = current
@@ -136,7 +136,7 @@ impl UdfFs {
            None => {
                return Err(Error::UdfNotFound {
                    path: path.to_string(),
-                })
+                });
            }
        };
        let entry = current
@@ -375,7 +375,7 @@ impl UdfFs {
            None => {
                return Err(Error::UdfNotFound {
                    path: path.to_string(),
-                })
+                });
            }
        };
        let entry = current
@@ -73,8 +73,8 @@ fn css_is_scrambled_detection() {
 /// then decrypt with decrypt_unit() and verify the plaintext matches.
 #[test]
 fn aacs_decrypt_unit_roundtrip() {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
    use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};

    let unit_key = [0xAAu8; 16];
    let aacs_iv: [u8; 16] = [
@@ -207,8 +207,8 @@ fn aacs_disc_hash_deterministic() {
 /// decrypt_unit_key recovers the original.
 #[test]
 fn aacs_decrypt_unit_key_roundtrip() {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
    use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};

    let vuk = [
        0x11u8, 0x14, 0x36, 0x0B, 0x10, 0xEE, 0x6E, 0xAC, 0x78, 0xAA, 0x4A, 0xC0, 0xB7, 0x52, 0xEA,
@@ -309,8 +309,8 @@ fn aacs_decrypt_unit_unencrypted_passthrough() {

 /// Independent AES-128-ECB encrypt (uses `aes` crate directly, NOT our library).
 fn ref_aes_ecb_encrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
    use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
    let cipher = Aes128::new(GenericArray::from_slice(key));
    let mut block = GenericArray::clone_from_slice(data);
    cipher.encrypt_block(&mut block);
@@ -321,8 +321,8 @@ fn ref_aes_ecb_encrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {

 /// Independent AES-128-CBC encrypt (uses `aes` crate directly, NOT our library).
 fn ref_aes_cbc_encrypt(key: &[u8; 16], iv: &[u8; 16], data: &mut [u8]) {
-    use aes::cipher::{generic_array::GenericArray, BlockEncrypt, KeyInit};
    use aes::Aes128;
+    use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
    let cipher = Aes128::new(GenericArray::from_slice(key));
    let mut prev = *iv;
    let num_blocks = data.len() / 16;
@@ -703,7 +703,7 @@ fn aacs_parse_unit_key_ro_minimal() {
    data[0..4].copy_from_slice(&uk_pos.to_be_bytes());
    // app_type
    data[16] = 1; // BD-ROM
-                  // num_bdmv_dir
+    // num_bdmv_dir
    data[17] = 1;
    // flags
    data[18] = 0;
@@ -1,7 +1,7 @@
 //! Disc scanning pipeline tests.

-use libfreemkv::error::Result;
 use libfreemkv::SectorReader;
+use libfreemkv::error::Result;
 use libfreemkv::{Disc, DiscTitle, ScanOptions};
 use std::collections::HashMap;

@@ -21,7 +21,13 @@ impl MockSectorReader {
 }

 impl SectorReader for MockSectorReader {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8], _recovery: bool) -> Result<usize> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
        let total = count as usize * SECTOR_SIZE;
        for i in 0..count as u32 {
            let offset = i as usize * SECTOR_SIZE;
@@ -1,7 +1,7 @@
 //! UDF parser tests using a MockSectorReader.

 use libfreemkv::error::Result;
-use libfreemkv::{read_filesystem, SectorReader};
+use libfreemkv::{SectorReader, read_filesystem};
 use std::collections::HashMap;

 const SECTOR_SIZE: usize = 2048;
@@ -39,7 +39,13 @@ impl MockSectorReader {
 }

 impl SectorReader for MockSectorReader {
-    fn read_sectors(&mut self, lba: u32, count: u16, buf: &mut [u8], _recovery: bool) -> Result<usize> {
+    fn read_sectors(
+        &mut self,
+        lba: u32,
+        count: u16,
+        buf: &mut [u8],
+        _recovery: bool,
+    ) -> Result<usize> {
        let total = count as usize * SECTOR_SIZE;
        assert!(buf.len() >= total, "buffer too small");
        for i in 0..count as u32 {
Author	SHA1	Message	Date
MattJackson	37e721ee7e	v0.12.2: hide halt behind checked_sleep / checked_exec primitives Drive::read is now halt-check-free in its body. Previously, the halt flag was checked in 4 places and the sleep logic was scattered across 4 "if halt_aware_sleep { return Halted }" call sites — correct, but the ugliness invited drift: a new sleep added by someone unfamiliar with the pattern would silently swallow Stop requests. Two private primitives now own halt awareness: checked_sleep(Duration) -> Result<()> checked_exec(cdb, dir, buf, timeout_ms) -> Result<ScsiResult> Both return Err(Halted) instead of a bool. The ? operator in read() then propagates halts for free. The recovery path reads top-to-bottom with no halt vocabulary. sleep_until_halted lives as a free function so it's unit-testable without a live Drive. 4 new tests: completes normally, bails on pre-set flag within one slice, wakes mid-sleep, zero-duration no-op. Public API unchanged — halt_flag/halt/clear_halt still exposed, the refactor is entirely internal.	2026-04-24 13:12:24 -07:00
MattJackson	481b47d90d	v0.12.1: halt-aware sleeps in Drive::read recovery Stop was waiting up to 30 s to register when the drive hit L-EC recovery mid-read — the recovery phase does 30 s sleeps between retries and the halt flag was only checked at the start of each sleep. UI feels broken ("stop isnt working") even though the halt was set. halt_aware_sleep breaks each wait into 100 ms slices and returns early on halt. Applied to all 4 sleeps in the recovery path (both 30 s retry delays, both 5 s reset-phase delays).	2026-04-24 12:59:36 -07:00
MattJackson	dd7cbd70a9	v0.12.1: cut non-recovery read timeout 5s → 1500ms Disc::copy fast pass (skip_on_error=true, recovery=false) was giving the drive 5 s per 64 KB block. On structure-protected / marginal UHD sectors the drive grinds L-EC for nearly the full budget per block, pinning throughput at ~13 KB/s even though skip_forward would happily skip past the region. 1500ms bounds the floor at ~43 KB/s/block. Recoverable sectors that would have succeeded at 3-5 s get picked up on Disc::patch (pass 2+) where recovery=true and the per-read budget is 30 s.	2026-04-24 12:57:53 -07:00
MattJackson	3dea679dac	style: cargo fmt	2026-04-24 12:23:42 -07:00
MattJackson	64ecca0d12	fix(windows): Rust 2024 requires unsafe extern blocks Missed in the prior 2024 edition sweep because local builds don't exercise the cfg(target_os = "windows") path. check-windows CI caught it.	2026-04-24 12:21:43 -07:00
MattJackson	84f6baba38	v0.12.0: Rust 2024 edition migration - edition = "2024" bump. - FFI block in src/scsi/macos.rs wrapped in `unsafe extern "C" { }`. - vtable_fn body gets an explicit unsafe block (unsafe_op_in_unsafe_fn). - Match-ergonomics cleanup in mux/meta.rs, mkvstream.rs, network.rs, stdio.rs — removed redundant `ref` / `ref mut` bindings. MSRV unchanged at 1.86. 226 tests pass. No behavior change.	2026-04-24 12:07:05 -07:00
MattJackson	bd5b7795bd	docs: multi-pass recovery — README snippet + new rip-recovery.md - README quick-start gains a multi-pass example using the new Disc::copy + Disc::patch primitives. - New docs/rip-recovery.md documents the two-stage rip model: mapfile format (ddrescue-compatible), CopyOptions/PatchOptions surface, the pass-1/pass-2 algorithm, and the design decisions (why no MODE SELECT, why ISO intermediate, why ddrescue mapfile). No code change.	2026-04-24 11:53:28 -07:00
MattJackson	a57506c1ce	v0.11.22: version sync — no functional changes autorip 0.11.22 ships the full multi-pass UI (live mapfile stats, bad-range viz, Recovery settings). libfreemkv API is unchanged from 0.11.21. Part of the 0.11.22 ecosystem sync.	2026-04-24 11:43:32 -07:00
MattJackson	c33f3e9557	v0.11.21: multi-pass rip — Disc::copy + Disc::patch + mapfile module New primitives for two-stage rip workflows: fast forward pass with zero-fill on failures, then targeted retries of bad ranges via a ddrescue-compatible mapfile. - Disc::copy now takes &CopyOptions (breaking change from positional args). Always writes a sidecar .mapfile. Opt-in skip_on_error + skip_forward give ddrescue-style fast sweep: 64 KB blocks, exponential skip-forward on failure, zero-fill bad blocks. Defaults preserve pre-0.11.21 behavior (recovery reads, abort on bad sector). - Disc::patch is new and idempotent. Reads the mapfile, re-reads every non-finished range with full drive recovery, patches good bytes back into the ISO at exact offsets. Call N times for N retry attempts. - disc::mapfile is a new module. ddrescue text format, crash-safe (flushed on every record()), greppable, human-editable, tool-compatible. Status chars match ddrescue: ? / * / / / - / +. - Re-exports FileSectorReader from the crate root. - freemkv CLI caller (pipe.rs) updated to the new Disc::copy signature in lockstep — shipped in the 0.11.21 freemkv CLI release. Part of the 0.11.21 ecosystem sync (libfreemkv + freemkv + bdemu + autorip all on 0.11.21).	2026-04-24 09:24:32 -07:00
MattJackson	166fc4bf8c	v0.11.18: DiscStream halt flag — Stop works in dense bad-sector regions DiscStream::fill_extents loops internally while the demuxer waits for enough clean data to emit a PES frame. In a dense bad zone that loop can run for minutes without returning to the outer read() call, so the caller's Stop signal never gets serviced until a frame is finally emitted — which may be very far away. Add DiscStream::set_halt(Arc<AtomicBool>) — typically wired to Drive::halt_flag() for unified Stop across drive recovery phases and stream sector processing. fill_extents checks the flag at the top of every retry iteration; raising it returns Err(Error::Halted) within one SCSI round-trip. No behavior change for callers that don't call set_halt. Unblocks the architectural fix for the "Stop doesn't stop" bug observed on a damaged UHD disc.	2026-04-24 07:41:13 -07:00
MattJackson	9aaddaa9b8	v0.11.17: adaptive batch sizer — no per-sector descent Replace read_with_binary_search + 3×5s light recovery with an adaptive sizer that shrinks on failure (halve, 3-aligned ≥6) and probes back up after 100 MiB (51,200 sectors) of clean reads. Descent cost is paid once per bad region, not once per bad sector. Emit BatchSizeChanged { new_size, reason } on shrink and probe-up. Remove BinarySearch event — no longer produced. Side fix: scsi/macos.rs one-liner for manual_c_str_literals clippy lint that surfaced on a newer toolchain.	2026-04-23 20:24:40 -07:00