549 changed files with 92489 additions and 216661 deletions
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@ -1 +0,0 @@
-github: MattJackson
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -1,33 +0,0 @@
-# Version updates are monthly and grouped into one PR per ecosystem.
-# Security updates are separate and run whenever an advisory is published.
-version: 2
-updates:
- package-ecosystem: cargo
-  directory: /
-  target-branch: dev
-  schedule:
-    interval: monthly
-  open-pull-requests-limit: 5
-  groups:
-    all:
-      patterns:
-      - '*'
-  ignore:
-  - dependency-name: freemkv-unlock
-  - dependency-name: libfreemkv
-  - dependency-name: freemkv-keysources
-  - dependency-name: freemkv-i18n
-  - dependency-name: freemkv-engine
- package-ecosystem: github-actions
-  directory: /
-  target-branch: dev
-  schedule:
-    interval: monthly
-  open-pull-requests-limit: 5
-  groups:
-    all:
-      patterns:
-      - '*'
-  ignore:
-  - dependency-name: dtolnay/rust-toolchain
-  - dependency-name: freemkv/.github*
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -2,306 +2,50 @@ name: CI

 on:
  push:
-    # dev -> qa -> main. `dev` is where work lands and is pushed to often: these
-    # are the FAST checks. `qa` runs these plus the expensive suite in qa.yml.
-    # `main` only moves at release time, to a commit already green on qa.
-    branches: [main, dev, qa]
+    branches: [main]
  pull_request:

-# Rapid dev pushes supersede their own in-progress runs instead of stacking.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  # Single source of truth for the MSRV: `rust-version` in Cargo.toml. Every job
-  # that builds AT the MSRV consumes needs.resolve-msrv.outputs.v so the floor
-  # cannot drift. clippy and `consumers` deliberately run on `stable`.
-  resolve-msrv:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      v: ${{ steps.msrv.outputs.v }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - id: msrv
-        shell: bash
-        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
-
-  # main may never carry a released version without a CHANGELOG.md entry. Hard-
-  # fails on main (and PRs to main); warns elsewhere so an in-progress branch
-  # whose entry isn't written yet is not blocked.
-  changelog:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - name: Require a CHANGELOG entry for the crate version on main
-        shell: bash
-        run: |
-          set -euo pipefail
-          version=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
-          if grep -qE "^## \[${version}\]" CHANGELOG.md; then
-            echo "CHANGELOG.md has an entry for ${version}."
-            exit 0
-          fi
-          msg="CHANGELOG.md has no '## [${version}]' entry"
-          if [ "${GITHUB_REF_NAME:-}" = "main" ] || [ "${GITHUB_BASE_REF:-}" = "main" ]; then
-            echo "::error::${msg} — main requires a changelog entry for the released version."
-            exit 1
-          fi
-          echo "::warning::${msg} (allowed on ${GITHUB_REF_NAME:-unknown}; required before it can reach main)."
-
-  # fmt on the pinned MSRV; clippy on stable so new-lint debt is a blocking gate
-  # the pinned version would hide. --all-targets lints test code too.
  lint:
-    needs: resolve-msrv
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.86.0
        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          components: clippy
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-          components: rustfmt
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
      - run: cargo fmt --check
-        working-directory: libfreemkv
-      - run: cargo +stable clippy --all-targets -- -D warnings
-        working-directory: libfreemkv
+      # libfreemkv is a library — Cargo.lock is gitignored. --locked
+      # would always fail on a fresh runner because there's no committed
+      # lockfile to lock against. The binary crates (freemkv, autorip,
+      # bdemu) track Cargo.lock and DO use --locked.
+      - run: cargo clippy -- -D warnings

  test:
-    needs: resolve-msrv
    runs-on: ubuntu-latest
-    timeout-minutes: 45
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.86.0
+      - uses: Swatinem/rust-cache@v2
      - run: cargo test --tests
-        working-directory: libfreemkv
-      # `--tests` skips doctests; the keys compile_fail doctests enforce spec LK19.
-      - run: cargo test --doc
-        working-directory: libfreemkv

-  # The memory orderings in `scsi::fd_handoff` (and `halt`) compile to the same instructions
-  # on x86_64, so the WRONG ones pass every run; loom enumerates the executions
-  # the C++20 model permits and is the only regression coverage that code has.
-  # Its own job because RUSTFLAGS is part of the rust-cache key. Takes the sibling
-  # checkout even with --no-default-features: features don't exempt an optional
-  # path dep from manifest RESOLUTION.
-  loom:
-    needs: resolve-msrv
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      RUSTFLAGS: --cfg loom
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-          components: clippy
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      - run: cargo test --lib --no-default-features --features scsi fd_handoff
-        working-directory: libfreemkv
-      # LT3: `Halt`'s cancel Release / observe Acquire pair (stop design §2.1, SS-23).
-      - run: cargo test --lib --no-default-features --features scsi loom_halt
-        working-directory: libfreemkv
-      # `lint` runs clippy without --cfg loom, so this is the only place the
-      # model code is linted at all.
-      - run: cargo clippy --lib --no-default-features --features scsi --profile test -- -D warnings
-        working-directory: libfreemkv
-
-  deny:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-      - uses: taiki-e/install-action@cargo-deny
-      # Run from the repo dir so the generated .cargo/config.toml path patches apply.
-      - run: cargo deny --all-features check advisories bans licenses sources
-        working-directory: libfreemkv
-
-  # dev is the FAST lane: the platform jobs run on qa/main only (qa.yml also
-  # covers macOS/Windows). `if` SKIPS (does not queue) so a never-scheduled job
-  # can't block the release gate.
  check-macos:
-    needs: resolve-msrv
-    if: github.ref_name == 'qa' || github.ref_name == 'main'
    runs-on: macos-latest
-    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.86.0
+      - uses: Swatinem/rust-cache@v2
      - run: cargo check
-        working-directory: libfreemkv

  check-windows:
-    needs: resolve-msrv
-    if: github.ref_name == 'qa' || github.ref_name == 'main'
    runs-on: windows-latest
-    timeout-minutes: 45
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      # Build the tests: forces full codegen of the Windows-only SPTI transport
-      # (src/scsi/windows.rs), which never compiles on Linux/macOS dev hosts.
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.86.0
+      - uses: Swatinem/rust-cache@v2
+      # Build the tests (not just `cargo check`): catches errors in test
+      # code and forces full codegen of the Windows-only SPTI transport
+      # (src/scsi/windows.rs), which never compiles on the Linux/macOS dev
+      # hosts. We don't `cargo test` here — the suite needs no drive but the
+      # extra build is the value; running tests is covered by the Linux job.
      - run: cargo build --tests
-        working-directory: libfreemkv
-
-  # Did this change break anything downstream? libfreemkv sits below all four
-  # dependents; a break here is worth strictly more than anywhere else. Runs
-  # their suites (not just check) — a behavioural change keeps signatures but
-  # fails a dependent's tests, which is the shape worth catching. This caught an
-  # engine fixture break the moment it landed, so it stays on the dev fast lane.
-  consumers:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with: { path: libfreemkv }
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock freemkv-keysources freemkv-engine freemkv-i18n freemkv bdemu
-      - name: Point every dependent at THIS libfreemkv commit
-        shell: bash
-        run: |
-          for c in freemkv-keysources freemkv-engine freemkv bdemu; do
-            mkdir -p "$c/.cargo"
-            cat > "$c/.cargo/config.toml" <<'EOF'
-          [patch.crates-io]
-          libfreemkv = { path = "../libfreemkv" }
-          freemkv-keysources = { path = "../freemkv-keysources" }
-          freemkv-engine = { path = "../freemkv-engine" }
-          freemkv-i18n = { path = "../freemkv-i18n" }
-          freemkv-unlock = { path = "../freemkv-unlock" }
-          EOF
-          done
-      # freemkv's app build (`--features gui`) compiles a GTK4 + libadwaita
-      # shell, so testing it needs these pkg-config dev headers.
-      - name: Install GTK4 + libadwaita development headers (for freemkv)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-4-dev libadwaita-1-dev build-essential
-      # Dependents track the highest supported Rust — build on stable so this job
-      # satisfies the highest dependent floor (the library's own lower MSRV, which
-      # the `test` job verifies, cannot compile them).
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: |
-            freemkv-keysources
-            freemkv-engine
-            freemkv
-            bdemu
-      - run: cargo test --tests
-        working-directory: freemkv-keysources
-      - run: cargo test --tests
-        working-directory: freemkv-engine
-      - run: cargo test --tests
-        working-directory: freemkv
-      - run: cargo test --tests --features gui
-        working-directory: freemkv
-      - run: cargo test --tests
-        working-directory: bdemu
-
-  # Coverage: non-required, informational only (codecov.yml), no job needs: it.
-  coverage:
-    needs: resolve-msrv
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-          components: llvm-tools-preview
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      - uses: taiki-e/install-action@72f835688cb6c15903b796f704b01e652a2b8835 # cargo-llvm-cov
-      - run: cargo llvm-cov --workspace --ignore-run-fail --lcov --output-path lcov.info
-        working-directory: libfreemkv
-      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: libfreemkv/lcov.info
-          slug: freemkv/libfreemkv
-          fail_ci_if_error: false
--- a/.github/workflows/comment-guard.yml
+++ b/.github/workflows/comment-guard.yml
@ -1,12 +0,0 @@
-name: comment-guard
-
-# Thin caller → the canonical reusable guard in freemkv/.github (one definition
-# for every repo). Fork PRs still run it; same-repo pushes aren't double-run.
-on: [push, pull_request]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-jobs:
-  comment-guard:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
-    uses: freemkv/.github/.github/workflows/guard-comment.yml@v2
--- a/.github/workflows/doc-links.yml
+++ b/.github/workflows/doc-links.yml
@ -1,18 +0,0 @@
-name: doc-links
-
-# Thin caller → the canonical reusable doc-links gate in freemkv/.github.
-# libfreemkv deps freemkv-unlock by version (git-tag override), so the reusable
-# checks it out as a sibling and path-patches it, and resolves the toolchain
-# from rust-version.
-on: [push, pull_request]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-jobs:
-  doc-links:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
-    uses: freemkv/.github/.github/workflows/guard-doclinks.yml@v1
-    with:
-      self: libfreemkv
-      checkout: freemkv-unlock
-      patch: freemkv-unlock
--- a/.github/workflows/ffmpeg-validation.yml
+++ b/.github/workflows/ffmpeg-validation.yml
@ -1,58 +0,0 @@
-name: FFmpeg validation
-
-# Called by qa.yml on pushes to qa, or manually for a development branch.
-# Pure Rust tests remain in dev CI; these tests require external codecs.
-on:
-  workflow_call:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  validate:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    env:
-      FREEMKV_FFMPEG_ARTIFACT_DIR: ${{ github.workspace }}/ffmpeg-artifacts
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - name: Read the crate's MSRV
-        id: msrv
-        working-directory: libfreemkv
-        run: echo "v=$(sed -n 's/^rust-version = "\(.*\)"/\1/p' Cargo.toml)" >> "$GITHUB_OUTPUT"
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ steps.msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      - name: Install software encoders and decoders
-        run: sudo apt-get update && sudo apt-get install -y ffmpeg
-      - name: Record tool versions
-        run: |
-          mkdir -p "$FREEMKV_FFMPEG_ARTIFACT_DIR"
-          ffmpeg -version > "$FREEMKV_FFMPEG_ARTIFACT_DIR/ffmpeg-version.txt"
-          ffprobe -version > "$FREEMKV_FFMPEG_ARTIFACT_DIR/ffprobe-version.txt"
-          rustc --version > "$FREEMKV_FFMPEG_ARTIFACT_DIR/rustc-version.txt"
-      - name: Generate fixtures and validate libfreemkv output
-        working-directory: libfreemkv
-        shell: bash
-        run: |
-          set -o pipefail
-          cargo test --release --lib ffmpeg_ -- --ignored --nocapture 2>&1 | tee "$FREEMKV_FFMPEG_ARTIFACT_DIR/tests.log"
-      - name: Upload fixtures, probes, hashes and logs
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: ffmpeg-validation-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ env.FREEMKV_FFMPEG_ARTIFACT_DIR }}
-          if-no-files-found: warn
-          retention-days: 14
--- a/.github/workflows/identity-guard.yml
+++ b/.github/workflows/identity-guard.yml
@ -1,14 +0,0 @@
-name: identity-guard
-
-# Thin caller → the canonical reusable guard in freemkv/.github.
-on:
-  push:
-    branches: [dev, qa, main]
-  pull_request:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-jobs:
-  identity:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
-    uses: freemkv/.github/.github/workflows/guard-identity.yml@v1
--- a/.github/workflows/leak-guard.yml
+++ b/.github/workflows/leak-guard.yml
@ -1,11 +1,35 @@
 name: leak-guard

-# Thin caller → the canonical reusable guard in freemkv/.github.
+# Self-contained public-repo leak gate. Public CI cannot reach the private
+# tooling, so this encodes only the generic net: internal-infra references,
+# tracked CLAUDE.md/.claude paths, and AI-attribution in commit messages.
+# No project-specific reverse-engineering vocabulary lives here.
+
 on: [push, pull_request]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+
 jobs:
  leak-guard:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
-    uses: freemkv/.github/.github/workflows/guard-leak.yml@v1
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Compute commit range
+        id: range
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            base="${{ github.event.pull_request.base.sha }}"
+            head="${{ github.event.pull_request.head.sha }}"
+            echo "range=$base..$head" >> "$GITHUB_OUTPUT"
+          else
+            before="${{ github.event.before }}"
+            after="${{ github.sha }}"
+            # New branch / first push: github.event.before is all-zeros.
+            if [ -z "$before" ] || [ "$before" = "0000000000000000000000000000000000000000" ]; then
+              echo "range=$after" >> "$GITHUB_OUTPUT"
+            else
+              echo "range=$before..$after" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+      - name: Run leak-guard
+        run: bash ci/leak-guard.sh "${{ steps.range.outputs.range }}"
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@ -1,180 +0,0 @@
-name: qa
-
-# ── The qa gate: "is this production worth?" ────────────────────────────────
-#
-# dev -> qa -> main.
-#
-# `dev` is for committing often. ci.yml answers "is it green" in minutes with
-# fmt, clippy and the unit suite, so a mistake surfaces while it is still cheap
-# to fix. `qa` is the release-candidate branch, and THIS workflow is the claim
-# that a commit is production worth: everything expensive that can run without
-# physical media. `main` only ever receives a qa that went green here.
-#
-# Sibling repos are checked out at `qa`, NOT `dev`. A qa run that resolved its
-# dependencies from dev tips would be validating a combination that is not the
-# one being released, which is the exact failure this branch exists to prevent.
-#
-# What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
-# and no hosted runner has an optical drive or the image hoard. That coverage
-# lives in freemkv's qa.yml (the real-media EC2 matrix), not in this file.
-on:
-  push:
-    branches: [qa]
-  workflow_dispatch:
-
-# Rapid dev pushes supersede their own in-progress runs instead of stacking.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  # Single source of truth for the MSRV — see ci.yml. Jobs that build/test AT
-  # the MSRV read `needs.resolve-msrv.outputs.v` from Cargo.toml's rust-version;
-  # clippy (cross-lint) runs on stable instead.
-  resolve-msrv:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      v: ${{ steps.msrv.outputs.v }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - id: msrv
-        shell: bash
-        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
-
-  # ── Name the candidate ────────────────────────────────────────────────
-  #
-  # Every push to `qa` is a release candidate, so every push gets a tag:
-  # v<version>-rc<N>, N incrementing. That is the answer to "which build is on
-  # qa right now, and is it the one I tested?" — a question that otherwise gets
-  # answered from memory.
-  #
-  # This runs FIRST and does not depend on the gates, deliberately. A red
-  # candidate needs a name more than a green one does: "rc3 failed
-  # release-tests on windows" is a sentence you can act on; "qa is red" is not.
-  # Red on qa is a working gate, not an incident — it is the branch saying this
-  # is not production worth yet. Fix on dev, get dev green, push qa again.
-  #
-  # release.yml excludes v*-rc* so a candidate never publishes a release.
-  rc-tag:
-    # A manual dispatch from another branch must not stamp a candidate.
-    if: github.ref_name == 'qa'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - name: Stamp the next rc
-        shell: bash
-        run: |
-          set -euo pipefail
-          v=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
-          [ -n "$v" ] || { echo "no version in Cargo.toml" >&2; exit 1; }
-          # Numeric sort on the rc ordinal: -rc10 must beat -rc9, and a plain
-          # lexical sort gets that backwards from the tenth candidate on.
-          # Retry on a lost race for the same ordinal: refetch tags, recompute.
-          for attempt in 1 2 3 4 5; do
-            git fetch --tags --force origin
-            n=$(git tag -l "v$v-rc*" | sed "s|^v$v-rc||" | sort -n | tail -1)
-            tag="v$v-rc$(( ${n:-0} + 1 ))"
-            git tag "$tag"
-            git push origin "$tag" && break
-            git tag -d "$tag"
-            [ "$attempt" -lt 5 ] || { echo "could not push an rc tag" >&2; exit 1; }
-          done
-          echo "### Candidate \`$tag\`" >> "$GITHUB_STEP_SUMMARY"
-
-  # The debug suite runs on every dev push. Release is a DIFFERENT build:
-  # overflow checks are off, debug_assert! is compiled out, and inlining
-  # changes what the optimiser can prove. A test that only passes in debug is
-  # a test that never guarded the binary anyone actually ships.
-  release-tests:
-    needs: resolve-msrv
-    strategy:
-      fail-fast: false
-      matrix:
-        os: ['ubuntu-latest', 'macos-latest']
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      - run: cargo test --release --tests
-        working-directory: libfreemkv
-      - run: cargo test --release --doc
-        working-directory: libfreemkv
-
-  # Independent decoder/remux verification uses generated media and belongs
-  # on qa, alongside the release suite. Also runnable manually on a branch.
-  ffmpeg-validation:
-    uses: ./.github/workflows/ffmpeg-validation.yml
-    permissions:
-      contents: read
-
-  # clippy's output is target-dependent: cfg-gated code only gets linted on
-  # the target it compiles for. Linting solely on the dev machine's host
-  # target is how a lint that CI rejects reaches a push.
-  cross-lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      # clippy runs on stable (matches ci.yml's lint job); build/test stay on
-      # the MSRV pin. See ci.yml for why the lint toolchain need not be the MSRV.
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          components: clippy
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      - run: cargo clippy --all-targets -- -D warnings
-        working-directory: libfreemkv
-
-  # Windows compiles the tests but does not run them, matching the policy
-  # ci.yml already set. The value here is codegen: the #[cfg(windows)] halves
-  # of the SCSI transport and platform layers compile on no other runner, so
-  # without this they are first built at release time.
-  windows-build:
-    needs: resolve-msrv
-    runs-on: windows-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          path: libfreemkv
-      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
-        with:
-          checkout: freemkv-unlock
-          patch: freemkv-unlock
-          self: libfreemkv
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ needs.resolve-msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          workspaces: libfreemkv
-      - run: cargo build --release --tests
-        working-directory: libfreemkv
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -4,21 +4,15 @@ on:
  push:
    tags:
      - 'v*'
-      # NOT the release-candidate tags. Every push to `qa` stamps a
-      # v<version>-rc<N> so a run can be named, and 'v*' matches those too —
-      # which would have this workflow build and PUBLISH a GitHub release for
-      # every candidate, including the red ones.
-      - '!v*-rc*'

 permissions:
-  contents: read
+  contents: write

 jobs:
  verify:
    runs-on: ubuntu-latest
-    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v5
      - name: Verify Cargo.toml version matches tag
        run: |
          CARGO_VER="v$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"
@ -29,27 +23,20 @@ jobs:
          echo "Version match: $CARGO_VER"

  # Tests run as a PARALLEL TRIPWIRE: they fail the run if they fail, but the
-  # release job does NOT `needs:` this job. The tag decision was already
-  # gated by CI (ci.yml on dev, then a green qa.yml on the same commit). Binary consumers
+  # publish/release jobs do NOT `needs:` this job. The tag decision was already
+  # gated by the local precommit (same Rust 1.86, same commit). Binary consumers
  # (freemkv/autorip/bdemu) git-tag-pin libfreemkv and therefore start building
-  # the instant this tag exists — so this test job must NOT sit on their
-  # critical path.
+  # the instant this tag exists — so this test job and the crates.io publish
+  # below must NOT sit on their critical path.
  test:
    needs: verify
    runs-on: ubuntu-latest
-    timeout-minutes: 45
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - id: msrv
-        shell: bash
-        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ steps.msrv.outputs.v }}
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-      # Cargo.lock is now committed (issue #15), but --locked is still omitted:
-      # the sibling path-patch layout resolves the freemkv crates as path
-      # packages, which --locked can't satisfy.
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.86.0
+      - uses: Swatinem/rust-cache@v2
+      # libfreemkv is a library — Cargo.lock isn't tracked, so --locked
+      # would always fail (no lockfile to lock against on a fresh runner).
      - run: cargo test

  # NOTE: there is no crates.io publish job. libfreemkv is git-tag-only
@ -60,15 +47,12 @@ jobs:

  release:
    # Only needs `verify`; the GitHub Release can be cut as soon as the version
-    # check passes, in parallel with test.
+    # check passes, in parallel with test + publish.
    needs: verify
    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v5
      - name: Create GitHub Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
+        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@ -1,27 +0,0 @@
-name: Scorecard
-on:
-  branch_protection_rule:
-  schedule:
-    - cron: '22 9 * * 2'
-  push:
-    branches: ["dev"]
-permissions: read-all
-jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-      - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
-        with:
-          sarif_file: results.sarif
--- a/.github/workflows/update-readme.yml
+++ b/.github/workflows/update-readme.yml
@ -0,0 +1,36 @@
+name: Update README version
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: main
+          token: ${{ secrets.ORG_DISPATCH_TOKEN }}
+
+      - name: Update version in README
+        run: |
+          VERSION="${{ github.event.release.tag_name }}"
+          FILE="README.md"
+
+          # Update cargo dependency version (e.g. "0.2" -> "0.3")
+          MAJOR_MINOR="${VERSION#v}"
+          MAJOR_MINOR="${MAJOR_MINOR%.*}"
+          sed -i "s|libfreemkv = \"[0-9]*\.[0-9]*\"|libfreemkv = \"${MAJOR_MINOR}\"|" "$FILE"
+
+      - name: Commit and push
+        run: |
+          VERSION="${{ github.event.release.tag_name }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add README.md
+          git diff --cached --quiet || git commit -m "Update to libfreemkv ${VERSION}"
+          git push
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,5 @@
 /target
+Cargo.lock
 *.swp
 *.swo
 .DS_Store
@ -13,12 +14,3 @@ scratch/
 # internal agent context — never publish (path AND dir; leak-guard blocks both)
 CLAUDE.md
 .claude/
-
-# Nightly harness output. Written into the repo it audits, and it embeds
-# absolute paths from the machine that ran it — which must never reach a public
-# repo. Ignored rather than relocated so a run from any working copy is safe.
-.nightly/
-
-# cargo-mutants working output: large, machine-specific, never committed
-mutants.out/
-mutants.out.old/
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, and also applies when

 ## Enforcement

-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported privately to the project maintainer via GitHub at https://github.com/MattJackson. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at owner@example.invalid. All complaints will be reviewed and investigated promptly and fairly.

 All community leaders are obligated to respect the privacy and security of the reporter of any incident.

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -16,17 +16,6 @@ cargo build
 cargo test
 ```

-### Parity goldens
-
-`parity_*` tests pin what every input-to-output path produces today (output hashes, loss
-counters, refusal codes) in `tests/goldens/*.golden`. A change that moves one must say why.
-Re-bless on purpose, then review the diff:
-
-```bash
-FREEMKV_BLESS_GOLDENS=1 cargo test --lib parity_
-git diff tests/goldens
-```
-
 ## Code style

 - Follow Rust conventions (`cargo fmt`, `cargo clippy`)
--- a/Cargo.lock
+++ b/Cargo.lock
@ -1,863 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "aes"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
-dependencies = [
- "cipher",
- "cpubits",
- "cpufeatures",
-]
-
-[[package]]
-name = "aho-corasick"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "base64"
-version = "0.23.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
-
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "cc"
-version = "1.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
-dependencies = [
- "find-msvc-tools",
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "chacha20"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "rand_core",
-]
-
-[[package]]
-name = "cipher"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
-dependencies = [
- "crypto-common",
- "inout",
-]
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "cpubits"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc32fast"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
-]
-
-[[package]]
-name = "either"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
-
-[[package]]
-name = "flate2"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
-dependencies = [
- "zlib-rs",
-]
-
-[[package]]
-name = "freemkv-unlock"
-version = "1.8.0"
-dependencies = [
- "aes",
- "base64",
- "num-bigint",
- "num-traits",
- "pioneer-optical",
- "rand",
- "serde",
- "serde_json",
- "sha1",
- "sha2",
- "tracing",
- "zeroize",
-]
-
-[[package]]
-name = "generator"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "log",
- "rustversion",
- "windows-link",
- "windows-result",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
- "rand_core",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
-dependencies = [
- "equivalent",
- "hashbrown",
-]
-
-[[package]]
-name = "inout"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "libc"
-version = "0.2.189"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
-
-[[package]]
-name = "libfreemkv"
-version = "1.8.0"
-dependencies = [
- "aes",
- "base64",
- "crossbeam-channel",
- "flate2",
- "freemkv-unlock",
- "libc",
- "libfreemkv",
- "loom",
- "memchr",
- "rayon",
- "roxmltree",
- "rustix",
- "serde",
- "serde_json",
- "sha1",
- "sha2",
- "socket2",
- "tempfile",
- "tracing",
- "zip",
-]
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
-name = "log"
-version = "0.4.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
-
-[[package]]
-name = "loom"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
-dependencies = [
- "cfg-if",
- "generator",
- "scoped-tls",
- "tracing",
- "tracing-subscriber",
-]
-
-[[package]]
-name = "matchers"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
-dependencies = [
- "regex-automata",
-]
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "nu-ansi-term"
-version = "0.50.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "num-bigint"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-integer"
-version = "0.1.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "pioneer-optical"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf5074a27cc39fb664d0b994814ffe8530e3e8590aff0d104723332dbcb1abc4"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "rand"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
-dependencies = [
- "chacha20",
- "getrandom",
- "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
-
-[[package]]
-name = "rayon"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
-
-[[package]]
-name = "roxmltree"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1964b10c76125c36f8afe190065a4bf9a87bf324842c05701330bba9f1cacbb"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "rustix"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
-[[package]]
-name = "scoped-tls"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
-
-[[package]]
-name = "serde"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.151"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "sha1"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "sharded-slab"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
-dependencies = [
- "lazy_static",
-]
-
-[[package]]
-name = "shlex"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
-
-[[package]]
-name = "simd-adler32"
-version = "0.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
-
-[[package]]
-name = "smallvec"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
-
-[[package]]
-name = "socket2"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.119"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
-dependencies = [
- "fastrand",
- "getrandom",
- "once_cell",
- "rustix",
- "windows-sys",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "tracing"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
-dependencies = [
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
-dependencies = [
- "once_cell",
- "valuable",
-]
-
-[[package]]
-name = "tracing-log"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
-dependencies = [
- "log",
- "once_cell",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-subscriber"
-version = "0.3.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
-dependencies = [
- "matchers",
- "nu-ansi-term",
- "once_cell",
- "regex-automata",
- "sharded-slab",
- "smallvec",
- "thread_local",
- "tracing",
- "tracing-core",
- "tracing-log",
-]
-
-[[package]]
-name = "typed-path"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "valuable"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "zeroize"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
-dependencies = [
- "zeroize_derive",
-]
-
-[[package]]
-name = "zeroize_derive"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "zip"
-version = "8.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
-dependencies = [
- "crc32fast",
- "flate2",
- "indexmap",
- "memchr",
- "typed-path",
- "zopfli",
-]
-
-[[package]]
-name = "zlib-rs"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
-
-[[package]]
-name = "zmij"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
-
-[[package]]
-name = "zopfli"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
-dependencies = [
- "bumpalo",
- "crc32fast",
- "log",
- "simd-adler32",
-]
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,8 +1,8 @@
 [package]
 name = "libfreemkv"
-version = "1.8.1"
+version = "1.4.4"
 edition = "2024"
-rust-version = "1.88"
+rust-version = "1.86"
 license = "MIT"
 description = "Open source raw disc access library for optical drives"
 repository = "https://github.com/freemkv/libfreemkv"
@ -18,93 +18,50 @@ publish = false
 lto = "thin"
 codegen-units = 1

-# ── Feature layout ───────────────────────────────────────────────────────────
-# `scsi`  — the SCSI passthrough transport layer ONLY (`src/scsi/` + `error`):
-#           ScsiTransport/execute, ScsiResult/ScsiSense/parse_sense, DriveInfo,
-#           list_drives, drive_has_disc, CDB builders, the per-OS backends and
-#           the raw-`cc` macOS shim (built by build.rs). Pulls only `tracing`
-#           (transport instrumentation) plus the always-on `libc` target dep —
-#           none of the ripping dependency tree.
-# `rip`   — the full ripping tree (drive lifecycle, disc/UDF/MPLS/CLPI parsing,
-#           AACS/CSS decrypt, PES/mux pipeline, keydb, freemkv-unlock seam). All
-#           heavy deps (serde, zip, rayon, roxmltree, crossbeam, memchr,
-#           sha1, sha2, aes, base64, socket2, rustix, freemkv-unlock, serde_json) live here.
-# `default = ["rip", "scsi"]` preserves today's full build byte-for-byte;
-# consumers wanting transport only use `default-features = false, features =
-# ["scsi"]`. `rip` implies `scsi` because the ripping tree reads through it.
-[features]
-default = ["rip", "scsi"]
-scsi = ["dep:tracing"]
-rip = [
-    "scsi",
-    "dep:serde",
-    "dep:serde_json",
-    "dep:sha1",
-    "dep:sha2",
-    "dep:aes",
-    "dep:freemkv-unlock",
-    "dep:zip",
-    "dep:flate2",
-    "dep:base64",
-    "dep:roxmltree",
-    "dep:crossbeam-channel",
-    "dep:rayon",
-    "dep:memchr",
-    "dep:socket2",
-    "dep:rustix",
-]
-# `test-util`: `libfreemkv::test_util` fixtures for consumers' tests (dev-dependency
-# only; never in a release build). Implies the rip tree the fixtures build on.
-test-util = ["rip"]
-
 [dependencies]
-serde = { version = "1", features = ["derive"], optional = true }
-serde_json = { version = "1", optional = true }
-sha1 = { version = "0.11", optional = true }
-# SHA-256 for the key-set fingerprints (VID and legacy key identity, keys-upfront §4.1, J18).
-sha2 = { version = "0.11", optional = true }
-aes = { version = "0.9", optional = true }
-# Resolved by the git-tag [patch.crates-io] below (re-pinned by
-# release-orchestrate.yml); local dev patches it to ../freemkv-unlock.
-freemkv-unlock = { version = "1.8", optional = true }
-zip = { version = "8", default-features = false, features = ["deflate"], optional = true }
-# zlib for Matroska ContentCompression (mkvmerge compresses S_VOBSUB by default); the
-# same backend `zip` already pulls in.
-flate2 = { version = "1.1", default-features = false, features = ["zlib-rs"], optional = true }
-base64 = { version = "0.23", optional = true }
-# Safe TCP keepalive setup for `network://` receive (dead-peer detection);
-# `all` provides TcpKeepalive::with_retries.
-socket2 = { version = "0.6", features = ["all"], optional = true }
-# Safe readiness poll (poll/WSAPoll) so a halt-aware `network://` receive never
-# arms SO_RCVTIMEO, which on Windows can drop data when it cancels a recv.
-rustix = { version = "1", default-features = false, features = ["std", "event"], optional = true }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha1 = "0.10"
+sha2 = "0.10"
+aes = "0.8"
+cbc = "0.1"
+# Interim path dep for local cross-repo dev; the release script re-pins this to
+# `{ git = ".../freemkv-unlock", tag = "vX.Y.Z" }` before tagging libfreemkv (so
+# the released tag resolves freemkv-unlock from git, not a sibling path).
+freemkv-unlock = { git = "https://github.com/freemkv/freemkv-unlock", tag = "v1.4.4" }
+num-bigint = "0.4"
+num-traits = "0.2"
+num-integer = "0.1"
+rand = "0.8"
+cmac = "0.7"
+zip = { version = "2", default-features = false, features = ["deflate"] }
+base64 = "0.22.1"
 # Read-only XML DOM parser (pure Rust, forbid(unsafe_code), entity-expansion
 # bounded). Parses the HD-DVD Advanced-Content playlist `ADV_OBJ/VPLST000.XPL`
 # — untrusted disc bytes — into authoritative titles/clips/chapters. A real
 # parser, not a hand-rolled scanner: the XPL is genuine XML (comments, varied
 # attribute order, self-closing tags).
-roxmltree = { version = "0.21", optional = true }
-# Trace-level instrumentation for the read/transport path (SgIoTransport::execute
-# and friends). Part of the `scsi` feature — the transport layer traces here.
-# Debug/trace logging is the permitted string output. Consumers (autorip) wire a
-# tracing subscriber and pipe events into the JSONL debug log.
-tracing = { version = "0.1", optional = true }
+roxmltree = "0.20"
+# Trace-level instrumentation for Disc::copy + SgIoTransport::execute. Permitted
+# under CLAUDE.md ("Acceptable strings: debug/trace logging"). Consumers (autorip)
+# wire a tracing subscriber and pipe events into the JSONL debug log.
+tracing = "0.1"
 # Bounded MPSC channel with kernel-wakeup send_timeout. Used by `io::pipeline`
 # so the halt-aware send/finish loops can BLOCK on consumer drain instead of
 # polling — the 50 ms poll cadence of the previous mpsc-based impl capped mux
 # throughput at ~1 MB/s (0.21.7).
-crossbeam-channel = { version = "0.5", optional = true }
+crossbeam-channel = "0.5"
 # Persistent work-stealing thread pool for parallel AACS unit
 # decryption. Per-call std::thread::scope spawned fresh OS threads
 # and that overhead dominated for typical batch sizes (60 units).
 # rayon's global pool initialises once on first use.
-rayon = { version = "1", optional = true }
+rayon = "1"
 # SIMD-accelerated bytestring search. Drives the HEVC/H.264 start-code
 # scan in `mux::codec::h264::find_start_code` — naive byte-by-byte
 # walk is ~500 MB/s single-thread on x86_64; memchr's vectorised
 # `memmem::find` for the 3-byte `00 00 01` needle hits ~5 GB/s on
 # AVX2-capable hosts.
-memchr = { version = "2", optional = true }
+memchr = "2"

 [target.'cfg(target_os = "linux")'.dependencies]
 libc = "0.2"
@ -114,43 +71,8 @@ libc = "0.2"

 [dev-dependencies]
 tempfile = "3"
-# The crate's own `test_util` for its integration tests (`tests/crypto_tests.rs` decrypts
-# through `test_util::decrypt_unit`; the unit decrypt is crate-private, KU §2.2).
-libfreemkv = { path = ".", features = ["test-util"] }
-
-# Permutation model checker for the `scsi::fd_handoff` atomics — the fd
-# hand-off between a Linux recovery thread and `SgIoTransport::drop`. A normal
-# test cannot see a missing release edge there: the orderings compile to the
-# same instructions on x86_64, so the wrong ones pass every time. loom
-# enumerates the executions the C++20 model permits and reports the leaked
-# descriptor directly.
-#
-# Behind `cfg(loom)`, which nothing sets unless you ask for it, so this is out
-# of the graph for every ordinary build and for every CI job but the dedicated
-# `loom` one. Run it with:
-#
-#     RUSTFLAGS="--cfg loom" cargo test --lib --no-default-features \
-#         --features scsi fd_handoff
-#
-# `cargo test --lib` specifically: as a DEV-dependency loom is only in scope for
-# test targets, which is why `fd_handoff` gates its import on `all(loom, test)`
-# and falls back to std elsewhere. Without that, `--cfg loom` would break plain
-# `cargo build`/`clippy` with an unresolved-crate error.
-[target.'cfg(loom)'.dev-dependencies]
-loom = "0.7"

 [[bench]]
 name = "sgio_read"
 harness = false

-# freemkv-unlock is off crates.io: resolve it from its GIT TAG. Consumers carry
-# the same patch; a gitignored .cargo/config.toml overrides it to a local path.
-[patch.crates-io]
-freemkv-unlock = { git = "https://github.com/freemkv/freemkv-unlock", tag = "v1.8.1" }
-
-[lints.rust]
-# `loom` is set by RUSTFLAGS for the model checker above, never by a feature.
-unexpected_cfgs = { level = "warn", check-cfg = ['cfg(loom)'] }
-
-[lints.clippy]
-uninlined_format_args = "allow"
--- a/LICENSES/LicenseRef-ISO-dist10.txt
+++ b/LICENSES/LicenseRef-ISO-dist10.txt
@ -1,11 +0,0 @@
-ISO/IEC 11172-5 reference software (dist10) -- table data
-
-src/mux/codec/testdata/dist10/alloc_0..3 are the Table 3-B.2a-d bit-allocation
-tables of ISO/IEC 11172-3 Annex B, as shipped in the ISO/MPEG Audio Subgroup
-Software Simulation Group's dist10 reference software (commit ea3c5ee of
-joncampbell123/iso-dist10). They are used here only as test data to check the
-Layer II parser.
-
-Copyright remains with ISO/IEC and the original authors of that software. No
-separate licence text accompanies these files; they are not covered by this
-project's MIT licence, and their terms are those of the dist10 distribution.
--- a/LICENSES/MIT.txt
+++ b/LICENSES/MIT.txt
@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Matthew Jackson & Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/Show more
+++ b/Show more